The risk register
Every accepted finding with its justification, owner, review date and history: statuses, reminders, renewal, closing and exports for an assessor.
The Risks page is the register of every finding your team decided to accept: the justification, the measures that compensate for it, an owner, a review date and the full history. It is the register a NIS2 or ISO 27001 assessor asks for. Nothing is deleted from it: a closed risk stays with its history.
The register is included from the Solo plan. On Free, accepted findings still leave the score, without dates, reminders or export.
The list
Each line shows the finding, its scope (one target on one domain, or every domain), its category, its owner, the next review and its status. It also says how many times the finding appears in the latest audits, or that it is no longer in them. Filter the list by status:
| Status | What it means |
|---|---|
| Active | Accepted and in force. |
| Review due | Its review or expiry date is within 30 days. |
| Expired | Its expiry date has passed: the finding counts in the score again. |
| Closed | Someone closed it, with a reason. |
The summary at the top counts the active risks, those to review and those expired.
A risk’s page
Open a risk to see the acceptance (who accepted it and when, the justification, the compensating measures, the owner, the dates, who approved it) and its history: accepted, edited, renewed, reminders sent, expired, closed, reopened.
Owners and admins can:
- Edit or renew: change the justification, the measures or the owner; to renew, set a new review or expiry date. Whoever saves approves it.
- Close this risk, with a reason (fixed, no longer needed…). The finding counts in the score again from the next audit; the risk stays in the register.
- Reopen a closed risk.
Members and viewers can read the register.
Reminders
The owner of a risk (or, when it has none, the owners and admins of the workspace) gets an e-mail 14 days before its review or expiry date, then once a week until something is done, and once more when the acceptance expires. The dates also appear under Coming due on the dashboard and in the deadline calendar.
Export for an assessor
Export (CSV) gives the register as a spreadsheet; Register (PDF) gives a document ready to hand over, with each risk, its justification, its measures, its owner and its dates.
To add a risk, accept a finding from a domain’s page or a report: see Accept a finding as a risk.