Risk Assessment
Risk analysis in the ISO 27005 style, with a treatment plan and residual risk. The threat catalogue is already built in: you start from the assessment, not from a blank sheet.
A risk analysis you do not rebuild in a spreadsheet every year
The risk analysis is the document on which the rest of a security management system stands. It is also the one most often rebuilt by hand, in a spreadsheet, every time an audit or a customer request comes along.
The Dottor Box Risk Assessment follows the approach of ISO/IEC 27005 and clauses 6.1 and 8.2 of ISO/IEC 27001. It starts from a threat catalogue already organised by category, has you assess likelihood and impact, asks you to write down how you intend to treat each risk and measures how much of it remains after the countermeasures.
Each analysis cycle is closed and kept on record with its date. The following year you start from the comparison, not from scratch. And what you assess here becomes evidence in the Compliance module for the standards that require it.
The comparison between inherent risk and residual risk is the output auditors ask for, and that hardly anyone has ready.
What you get
A preloaded catalogue
The threats are already present in every new Dottor Box, divided into categories and subcategories. You assess, you do not fill in.
A measure you can read
Likelihood by impact, from 1 to 25, in five colour-coded bands from Very Low to Very High.
Before and after
Treatment plan and residual risk: you see how much risk the countermeasures really remove.
Dated snapshots
Each analysis cycle is concluded and remains as a snapshot of that period, comparable with the ones that follow.
Threat categories ready to use
The catalogue covers the scenarios that a standard such as ISO/IEC 27001 expects to find in a risk analysis. Each threat can be marked as not applicable or to be completed: nothing ends up in the register by inertia, and nothing disappears without a decision.
- Environmental threats
- Technical failures
- Malicious compromise of information
- Human error and organisational shortcomings
- Supply incidents and problems
- Dependence on suppliers and skills
From assessing inherent risk to residual risk
For every threat in the catalogue the path is the same, and every step is recorded.
Assess the inherent risk
Likelihood from 1 to 5 by impact from 1 to 5. Impact is qualified in terms of confidentiality, integrity, availability, and legal and reputational effects.
Choose the owner
You take them from the response team directory, the same one used by the other modules: you fill it in once.
Write the treatment plan
Strategy, actions, resources, timescales and evaluation criteria: what you will do, with whom and by when.
Measure the residual risk
Likelihood and impact after treatment. The comparison with the inherent value shows what the work done is worth.
Every risk has an Owner
A risk register lists problems. Risk management gives someone the task of solving them. That is why every risk identified has an Owner: not the person who carries out the actions, but the one accountable for the result.
It is the person who follows the risk from assessment through to treatment and checks that the corrective actions really are carried out, supervising those who do them.
The single point of reference who holds ultimate responsibility for managing the risk, from its assessment through to its treatment.
A closed cycle is a document, not a draft
- Each analysis cycle is an event with its own date, selectable from the history
- When you conclude it, it becomes the snapshot of that period
- The following year you start again from the comparison with the previous cycle
- The results go into the PDF report
- The Compliance module shows them as evidence against the clauses that require them
- No re-entering by hand of data the platform already has
Which standards it supports
Risk assessment and treatment are required, in different words, by almost every security framework: from NIS2 to ISO/IEC 27001, through to the GDPR for risks to personal data.
Frequently asked questions about risk assessment
How often should the risk analysis be updated?
ISO/IEC 27001 requires it to be repeated at planned intervals and whenever there are significant changes, such as a new system, a reorganisation or an incident. In practice many companies review it at least once a year. In Dottor Box each cycle is a dated campaign, so the review starts from the previous cycle.
What is the difference between inherent risk and residual risk?
Inherent risk is the risk you run before specific countermeasures; residual risk is what remains after applying them. The difference between the two measures how effective the treatment plan is, and the residual risk is what management has to accept knowingly. What residual risk is.
Which risk analysis methodology does Dottor Box use?
It follows the approach of ISO/IEC 27005: for each threat, likelihood and impact are estimated on a scale of 1 to 5, and the product gives a value from 1 to 25 divided into five bands. It is a method that is simple to explain to management and to repeat over time with the same criteria, so the cycles remain comparable.
Is a risk assessment mandatory under NIS2 and the GDPR?
Yes. NIS2 requires risk management measures based on an all-hazards approach and policies on risk analysis. The GDPR requires security measures appropriate to the risk (Article 32) and, for high-risk processing, a data protection impact assessment. DORA and ISO/IEC 27001 also start from here.
Who should carry out the risk analysis in a company?
Management approves the criteria and accepts the residual risk; the assessment is usually carried out by the IT or security manager together with the process owners. The preloaded catalogue saves you starting from a blank sheet, and if you lack a skill in-house you can get support through consulting from our specialists.
Often activated together
Compliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more GovernBusiness continuity
Business Impact Analysis, continuity plan and backup checks, guided by questionnaires.
Learn more SeeVulnerability Assessment
Six checks from inside and outside, with CVSS severity, history and alerts on what is new.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.