#01
Every department has its own risk register in Excel
No consolidation, no overall view. A risk identified by IT is unknown to finance. Management has no unified view of organisational risks.
Module / ISO 31000
ISO 31000:2018 ; Risk Management.
Unified risk register. 4D scoring. KRI with 10 templates and alert thresholds. Treatment plans with PDCA cycle. Risk acceptance workflow. Executive reports for management.
Unified
Risk register
4D
4-dimension scoring
10
KRI templates
PDCA
Treatment cycle
Challenges
We know the risk management challenges.
Risk management in most organisations is a collection of spreadsheets and Word documents. These problems come up everywhere.
#02
Risk matrix updated once a year
The matrix is updated before the annual review, then left unchanged for 11 months. New risks appear, old ones materialise ; nobody reacts.
#03
Risk owners without a tracking tool
A risk owner is formally assigned but has no tool to track their risks, remediation deadlines or status.
#04
Risk reports assembled at the last minute
Before every board meeting someone hurriedly compiles a risk report from various spreadsheets. Something is always missing and the data is never current.
#05
No KRIs ; nobody knows when it is too late
The organisation has no defined Key Risk Indicators. Nobody monitors whether a risk is approaching the acceptance threshold. Reaction comes after the fact.
#06
GDPR, ISO 27001 and operational risk in silos
Compliance risk (GDPR), information risk (ISO 27001) and operational risk treated as separate registers. No unified view ; the same threats assessed multiple times inconsistently.
ISO 31000 process
5 steps of the risk management process.
ISO 31000 defines an iterative risk management process. RealSec reflects every step in a dedicated module.
01
Communication and consultation
Engaging stakeholders, communicating about risks, gathering perspectives and context
02
Scope, context and criteria
Internal and external context, risk management scope, acceptance criteria
03
Risk assessment
Threat identification, likelihood and impact analysis, evaluation against criteria
04
Risk treatment
Treatment options, PDCA action plans, implementation and effectiveness verification
05
Monitoring and review
KRI (10 templates), alert thresholds, internal audit, continual improvement
Features
Six tools. Full risk management.
Unified register, 4D scoring, PDCA plans, acceptance workflow, KRI with 10 templates and executive reports in one place.
01 / Unified Risk Register
Unified Risk Register
One central register for all organisational risks. Regulatory tags (GDPR, ISO 27001, DORA, NIS2) enable filtering by requirement. Risk categorisation: strategic, operational, technological, legal, reputational. Risk owner, prioritisation and change history.
- +One risk register for the whole organisation ; end of silos
- +Regulatory tags: GDPR, ISO 27001, DORA, NIS2, PCI DSS
- +Categorisation: strategic, operational, technological, legal
- +Risk owner, priority, status and version history
Risk / Register
UNIFIED RISK REGISTER 24 risks
R-014 Loss of customer personal data 20
R-007 Production system unavailability 15
R-021 Breach of DORA requirements 12
R-003 Departure of key IT staff 9
4D
Scoring
10
KRI templates
PDCA
Treatment
02 / 4-dimension scoring
Advanced scoring ; 4-dimension assessment
Risk assessment across 4 dimensions: likelihood, financial impact, operational impact, reputational impact. Each dimension rated 1-5. Configurable weights per dimension. Final score as a weighted average or maximum. 5x5 risk matrix with configurable acceptance thresholds.
- +4 assessment dimensions: likelihood, finance, operations, reputation
- +Configurable weights per dimension (e.g. finance 40%, operations 30%)
- +5x5 risk matrix with thresholds: acceptable / monitored / unacceptable
- +Inherent risk vs. residual risk after corrective actions
RealSec / Risk
4-dimension scoring ISO 31000
4 assessment dimensions: likelihood, finance, operations, reputation
Configurable weights per dimension (e.g. finance 40%, operations 30%)
5x5 risk matrix with thresholds: acceptable / monitored / unacceptable
Inherent risk vs. residual risk after corrective actions
03 / PDCA treatment plans
Treatment Plans with PDCA cycle
For every risk above the acceptance threshold: choose a treatment option (avoid / reduce / transfer / accept), action plan with deadlines and owners. PDCA cycle per plan ; Plan (schedule actions), Do (implement), Check (verify effectiveness), Act (correct and improve).
- +Four treatment options: avoid, reduce, transfer (insurance), accept
- +PDCA cycle per plan: Plan - Do - Check - Act with transition dates
- +Progress tracking ; how many actions completed, open, overdue
- +Residual risk re-assessment after implementation ; effectiveness verification in the Check phase
RealSec / Risk
PDCA treatment plans ISO 31000
Four treatment options: avoid, reduce, transfer (insurance), accept
PDCA cycle per plan: Plan - Do - Check - Act with transition dates
Progress tracking ; how many actions completed, open, overdue
Residual risk re-assessment after implementation ; effectiveness verification in the Check phase
04 / Risk Acceptance
Risk acceptance workflow
Formal process for accepting residual risk by an authorised person. Approval workflow: the risk owner requests acceptance, CISO/CRO reviews, management approves. Documentation of acceptance rationale with validity dates and mandatory review.
- +Acceptance workflow: request ; CISO/CRO review ; management approval
- +Documented acceptance rationale with risk level
- +Acceptance validity date ; mandatory review every 12 months
- +Register of all accepted risks with decision history
RealSec / Risk
Risk Acceptance ISO 31000
Acceptance workflow: request ; CISO/CRO review ; management approval
Documented acceptance rationale with risk level
Acceptance validity date ; mandatory review every 12 months
Register of all accepted risks with decision history
05 / KRI ; 10 templates
KRI Dashboard ; 10 templates, alert thresholds
10 ready-made KRI templates for typical organisational risks: security incidents, system availability, employee turnover, project delays, customer complaints and more. Each KRI with configurable thresholds (green/yellow/red). Automatic alerts when an indicator exceeds a threshold.
- +10 ready-made KRI templates ; immediately usable
- +Configurable thresholds per KRI: green / yellow / red
- +Automatic email alerts when an indicator exceeds the warning threshold
- +Historical KRI trend ; time-series charts for each indicator
RealSec / Risk
KRI ; 10 templates ISO 31000
10 ready-made KRI templates ; immediately usable
Configurable thresholds per KRI: green / yellow / red
Automatic email alerts when an indicator exceeds the warning threshold
Historical KRI trend ; time-series charts for each indicator
06 / Executive reports
Executive Reports for Management
Ready-made risk report templates for the board and supervisory board. Top 10 risks with trend changes since the last report. Heat map of all organisational risks. Progress of corrective actions. PDF export ; ready material for a board meeting.
- +Risk report template for the board ; aligned with best practices
- +Top 10 risks with trend (increased / unchanged / decreased) since the last report
- +Risk heat map ; one slide, full picture
- +PDF export ; ready for a board meeting without additional formatting
RealSec / Risk
Executive reports ISO 31000
Risk report template for the board ; aligned with best practices
Top 10 risks with trend (increased / unchanged / decreased) since the last report
Risk heat map ; one slide, full picture
PDF export ; ready for a board meeting without additional formatting
Advanced risk features
KRI, treatment plans, acceptance.
KRI Monitoring
10 auto-measurement templates, 3 alert thresholds (green/yellow/red), historical trend tracking.
Treatment Plans + PDCA
Mitigation, transfer, acceptance and avoidance strategies. PDCA cycle per plan with residual risk calculation.
Risk Acceptance Workflow
Formal risk acceptance with approval workflow, time limit and stakeholder alignment.
Advanced Scoring (4 dimensions)
Business impact, likelihood, control strength, detectability. Standard and Premium scoring.
Cross-module inheritance
Risk defined once, used in GDPR, ISO and DORA. Automatic propagation of changes.
ISO 31000 maturity model
22 controls with 0-5 heatmap, gap analysis per control, remediation roadmap.
FAQ
Frequently asked questions
Risk management guidelines: a framework for identifying, analysing, assessing and treating risk across the whole organisation, not only in information security.
ISO 31000 is the general risk management framework. ISO 27005 applies those principles specifically to information security risk.
The risk that remains after controls have been implemented. It is calculated after safeguards are applied, so it reflects the real state rather than the unprotected situation.
One risk register, scoring, PDCA cycle and KRI with alerts. A risk defined once is used in GDPR, ISO and DORA, with changes propagated automatically.
Ready for enterprise risk management?
A 30-minute demo session with an expert. See 4D scoring, KRI with 10 templates, PDCA plans and the risk acceptance workflow in action.