Risk Controls

Risk Controls represent something that an Organization does to reduce the likelihood of a Risk occurring.

Risk Control Strength and Implementation Ratings — Risk Sub-Controls each have a Strength Rating and an Implementation Rating. Both contribute to the overall effectiveness of a Risk Control Category. Strength Rating - Maximum percentage that a Control will reduce the likelihood of a risk occurring Implementation Rating - Percentage representing how well a Control is implemented across the whole Organization The total effectiveness is equal to the Strength Rating multiplied by the Implementation Rating Effectiveness = Strength * Implementation Each Rating can be edited on Risk Sub-Controls, which will in turn affect a Category’s total effectiveness. This can be seen in the details of each Category:

Risk Sub-Controls — Risk Sub-Controls are each individual measure taken to address a negative scenario that put an Organization at Risk. They are critical in assessing the risk of an Information System. e.g. A network firewall is in place. Each Sub-Control has an Implementation and Strength Rating to rate its effectiveness. Risk Sub-Controls can be linked to Evidence compliance or outsourced to a Vendor Sub-Control. Updates to those resources automatically update the Risk Sub-Control.

Set a System Sub-Control to "Non-Standard" — The Implementation Rating of a Non-Standard Risk Control is calculated separately from the Organization-level Risk Controls and carries it’s own Cost that factors into the Return on Investment calculations.

Risk Control Categories — A Risk Control Category is a grouping of similar Risk Sub-Controls that address a Key Risk Indicator. Ex. Granting access based on least privilege and requiring password complexity both address the Key Risk Indicator “Unauthorized Application Access”. A user cannot directly create a Risk Control Category the same way they would create a Sub-Control. They are automatically created when a new Key Risk Indicator is made. To Create a Key Risk Indicator

Create a Risk Sub-Control — A user can create a Sub-Control within a Risk Control Category.

Link an Evidence to a Risk Sub-Control — A User can attach an Evidence to a Risk Sub-Control to use in the Implementation Rating. The Implementation Rating is affected automatically based on the Evidence’s status. Each attached Evidence is weighted evenly along with linked Vendor Controls. e.g. Two in place Evidences, one in place and audited Vendor Control, and one Expired Evidence will result in a 75% Implementation Rating

Link a Vendor Control to a Risk Sub-Control — A User can link a Vendor Control and Risk Sub-Control. When the Vendor Control is set to in place and audited in a Vendor Review, it increases the Implementation rating of the linked Risk Sub-Control. The controls can be linked through the Risk module and the Vendor module.

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.