Identify, assess and treat risks systematically – from protection-requirement and threshold analyses to threat analyses, with graphical risk mapping. Aligned with BSI IT-Grundschutz and ISO 27001, and directly linkable to measures, assets and audits.
RISK IDENTIFICATION & ASSESSMENT
Risk analysis is the cornerstone of every information security management system. Create any risk analysis document – from protection requirement analyses through resource assessments and threshold analyses to threat analyses – and freely define events, damage assessments, and risk levels to suit your requirements.
MEASURES & COMPLIANCE
Link identified risks directly with measures and track which measure reduces which risk. Documented risk analyses support the implementation of BSI IT-Grundschutz and ISO 27001.
FAQ
You can create any risk analysis document you need, for example protection requirement analyzes, resource assessments, threshold analyzes or threat analyzes. A structured form guides you through the assessment. A risk analysis can stand alone or be linked to another document, such as an asset, a measure or an audit, so the assessment sits where the risk arises.
Yes. You define events, damage assessment and risk levels freely, so the analysis follows your existing methodology, for example a group-wide standard or your interpretation of BSI IT-Grundschutz and ISO 27001. preeco does not impose a fixed rating scheme. You download the results as PDF or DOCX, including a graphical representation of the risks.
Yes. Risk analyzes are designed to be answered by users, and the permission concept distinguishes between answering and editing. Business units assess the risks in their own area, while the information security officers remain responsible for the structure and criteria of the analysis. Tasks, comments and follow-ups on the risk analysis help your team keep track of open points.
The protection requirements assessment on an asset uses a damage scenario matrix to determine how much protection a system needs in terms of confidentiality, integrity and availability, and passes the result down the asset tree. A risk analysis, by contrast, looks at events and threats, assesses the resulting damage and assigns risk levels. The two complement each other: the protection requirement shows which systems merit a more detailed risk analysis.
You link a risk analysis directly to the measures that reduce a risk. In the ISMS Cockpit, the risk analysis appears as the origin of a measure, so in an audit you can show which assessment a measure comes from and which requirement it supports. Risks you consciously accept are documented as an exception on the requirement concerned, which then drops out of the compliance level.
Every time a risk analysis is released, preeco automatically creates an immutable revision, so earlier versions of the assessment remain available. All risk analysis documents are listed in a filterable overview. Follow-ups remind you of the next scheduled reassessment, and the activity log shows who performed which action on the analysis and when.
Risk analyzes belong to the extended functionality of preeco | information security and are licensed as a separate module, as are audits and online training. Together with your headcount and the hosting option, the modules you choose determine the price. The protection requirements assessment on assets, on the other hand, is part of the core functionality.
In a personal consultation, we will show you how preeco | information security simplifies your security management.