Platform · Risk management

NIS2 art. 21.2(a): risks assessed, treated and linked to the controls that reduce them.

NIS2 (art. 21.2(a)) and ISO/IEC 27001 require a risk analysis that drives the choice of measures; DORA (art. 5) makes the management body responsible for ICT risk. In EVIDEVO each risk has likelihood and impact on a shared scale, an owner, a treatment plan and the controls that reduce it, with their test outcomes. Residual risk is accepted through a recorded approval.

Let's talk Starting assessment

Data for illustrative purposes only, not real

The problem

01

Annual risk analysis

A document written for the audit and then filed away, which does not follow changes to systems and vendors.

02

Risks disconnected from measures

There is no record of which control reduces which risk, or whether that control works.

03

Undocumented acceptance

Residual risks are accepted verbally, with no date and no signatory.

What it does

Risk register with assessment, treatment, owners and recorded acceptance.

  • Risk register

    Threats, assets involved, likelihood and impact, on a shared scale.

  • Linked to controls

    Each risk shows the controls that reduce it and their test outcomes.

  • Treatment plans

    Actions with owner and deadline, tracked to closure.

  • Formal acceptance

    Residual risk is accepted through a recorded approval: who, when, at what risk level.

  • Periodic review

    Review reminders and comparison with the previous assessment.

  • Management body view

    Top risks and trend, in the format of the management body reports.

The outcome

  • A risk register with owner, level and treatment plan for each risk
  • For each risk, the linked controls and their test outcomes
  • Residual risk acceptances, with date and approver

Related frameworks

Other capabilities

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk