01
Justify priorities with operational context
A risk remains linked to assets, processes, vendors and existing controls. The team can explain why one treatment comes first and which dependencies it affects.
Risk management
Turn an assessment into accountable treatment.
KaitoSec keeps the risk, affected operational context, chosen treatment, owner and residual risk together. Security, process owners and leadership see the same decision at the right depth.
Where friction starts today
Why most risk registers are dead the moment they're saved
A risk register in a spreadsheet ages badly. Someone fills it in for the audit, scores twenty risks on a Friday afternoon, and by the next quarter half the entries describe systems that have changed and controls that were never actually built. The register passes the audit and then sits untouched until the next one.
The trouble is that a risk only means something when it connects to the rest of the operation: the asset it threatens, the control meant to reduce it, the recovery plan it triggers, the supplier who owns part of it. Keep those links in your head or across four separate tools and the register stops matching reality. When an auditor asks why a risk was accepted, you want the answer in the system, not in someone's memory.
One data model
What you enter here, the other modules already know
Modules are views on the same record, not separate databases. A change made here is the change every other module reads, with no export step and no second entry.
This module
Risk Management
Shared data model
One asset, one risk, one control, one piece of evidence
- Business ContinuityCurrent at once
- Asset ManagementCurrent at once
- Compliance MappingCurrent at once
Entry to evidence
Every change carries its own proof
An auditor rarely asks what the register says today. They ask who changed it, when, and on what basis. That trail is written while the work happens, so nothing has to be reconstructed at the end of the year.
One change
A risk is re-assessed
Written with it
- Previous value and version
- Person responsible
- Date and reason
Where it surfaces
- Management report
- Audit evidence
- Customer questionnaire
What changes for your team
02
Turn tolerance into a concrete escalation
Set tolerances by risk category, expose breaches and assign the owner and review cycle. A policy statement becomes a decision the team can work.
03
Keep acceptance and treatment defensible
Accept, mitigate, transfer or avoid: rationale, approval, owner, due date and residual risk stay with the same decision. Follow-up work is findable for the team, leadership and audit.
The workflow
01
Assessment and residual risk in one model
Assess likelihood and impact on a configurable scale and document the chosen treatment alongside it. The current view shows inherent and residual risk with its rationale.
02
Give follow-up work to the right owner
Create treatment tasks with an owner, due date and dependencies, then link them to controls, BIA, vendor review or AI governance. Each role sees the part it must complete.
03
Make reviews planned rather than sporadic
Set review cycles by risk or category, expose due dates and retain the outcome as a versioned decision. Security can see which assessment remains valid and where a new decision is missing.
FAQ
What is risk management in information security?
IT risk management identifies, assesses and treats risks to the confidentiality, integrity and availability of information. Its risk assessment methods follow ISO 27005 and BSI Standard 200-3 and connect directly to KaitoSec ISMS software.
How does a risk analysis according to BSI 200-3 work?
A BSI 200-3 risk analysis assesses and treats the elementary threats (G 0.x) affecting target objects with increased protection needs. KaitoSec automatically connects threats, modules and controls—see BSI IT-Grundschutz.
How are vendor risks recorded?
Vendor risks are recorded in KaitoSec in the same register as assets and processes, so they appear directly in the risk register. NIS2 and DORA require precisely this view—details are available under Vendor Management.
What is the difference between a risk register and a business impact analysis?
The risk register assesses likelihood and impact; the BIA determines recovery times for processes. Both use the same assets and processes, and KaitoSec feeds them from one register—see Business Continuity.
How is risk management reported to executive management?
Risk management is reported through a management view of top risks, open treatments and trends. In KaitoSec, Reporting is generated from current data, not from a separate slide deck.