CIYAJ سياج
العربية
Menu
Request a briefing

Risk

A risk register that people keep current.

Raise, assess, validate, treat or accept, monitor and report technology risks against your own risk standard, as the first line, with escalation to the enterprise register.

The life of a risk

  1. 01Raise
  2. 02Assess
  3. 03Validate
  4. 04Treat or accept
  5. 05Monitor
  6. 06Report
Illustrative data
Risk / RegisterAcme Organization
Technology risk registerResidualInherentCommittee pack
Open risks42
Above appetite3Escalated automatically
Treatment plans1861% on time
Indicator breaches2This month
Likelihood
5
1
1
1
4
2
3
2
3
1
4
6
2
2
2
5
4
1
1
3
3
1
1
2
3
4
5
Impact
  • RSK-2027-014CriticalAbove appetiteLegacy OT network without segmentationTreatment plan35%
  • RSK-2027-021HighAbove appetitePrivileged access reviews running lateTreatment plan60%
  • RSK-2027-009MediumWithin appetiteSingle vendor for security monitoringTreatment plan80%
Critical vulnerabilities open more than 30 days7Breach · re-assessment triggeredThreshold 5
Technology risk register

What Risk does

  • Risks from every sourceCompliance findings, exceptions and failed tests, policy exceptions, incidents, projects, vendors, workshops and audits. An existing register or an export from your IT service management platform can be uploaded, mapped and de-duplicated.
  • Your risk standard, read inLoad your enterprise risk standard as PDF, Word or Excel. CIYAJ builds the matrix, criteria and appetite from it, and every risk is re-rated when a new version is published.
  • Inherent, residual and targetImpact by criterion (financial, operational, regulatory, reputational, safety and data), likelihood, velocity and proximity, with optional quantified loss.
  • Appetite and toleranceLimits per category, with automatic escalation when a risk goes beyond them.
  • Controls that prove themselvesLinked compliance controls bring their test results, and their effectiveness suggests the residual rating. Policies in force count as controls.
  • Treatment and acceptanceMitigate, transfer, avoid or accept. Plans with actions, owners, dates and cost; acceptance by the right authority, with an expiry and re-review.
  • Key risk indicatorsThresholds, trends and breach alerts. A breach can trigger a re-assessment.
  • Reviews that keep it currentOwner re-attestation campaigns, workshops and re-assessment triggers.
  • Reports for the committeeInherent and residual heat maps, top risks, movement, appetite breaches, treatment aging and the committee pack, in PDF, Word and Excel.

First line, linked to the second

The line of defense is a setting. As the first line, CIYAJ keeps your register and exports and escalates to the enterprise register, without replacing it.

See CIYAJ against your own frameworks.

Tell us which frameworks are in scope and we will arrange a walkthrough with your team.

Request a briefing