Risk analyses overview and status tracking

The “Risk analyses” overview page is your workspace for all of your team’s risk assessments: at a glance you see which analysis has which status, what it relates to and when it was last answered. In an ISMS, this evidence is how you implement the risk assessment required by ISO/IEC 27001 and the risk analysis described in BSI IT-Grundschutz (BSI Standard 200-3).

Prerequisites

• You are logged into a team that uses the “Risk analyses” module.
• You have permission to view risk analyses.
• To create, edit, answer, share or delete, you also need the relevant permission in each case.

Step by step

1. In the left-hand menu, under “Risks”, click “Risk analyses”. The table lists all risk analyses of your team with the default columns “Status”, “Designation”, “Association”, “Last reply on”, “Linked to”, “Tasks” and “Tags”.
2. Enter a term in the “Search term” field to narrow the list down to matching risk analyses.
3. Click “Filter” to expand the filter area. The available filters are “Status”, “Designation”, “Association”, “Client numbers”, “Document ID”, “Tags”, “Document type”, “Created by” and the date filters “Last revision on”, “Follow-up on”, “Created before / after” and “Updated before / after”.
4. Use “Document type” when you only want to see analyses for a particular object of assessment — for example “Data processing systems” or “Technical and organizational measures”.
5. Use the “Columns” button at the top right to show additional columns such as “Document ID”, “Document type”, “Last activity”, “Last revision” or “Follow-up on”.
6. Sort by “Status”, “Designation”, “Last reply on”, “Linked to” or “Document type” using the column headings. The sorting currently applied is displayed above the table and can be removed there with “Reset”.
7. Save frequently needed filter and sort combinations in the “Views” selection menu so you can call them up again with one click.
8. Click anywhere in a row to open the detail view. There, click “Preview” at the top right to check the analysis in the page-by-page formatted rendering that is also generated for download. Close the preview using the X at the top right.

What the statuses mean

• “New” and “In progress”: the methodological framework is being maintained — events, damage items with their criteria, and risk levels. In these statuses the detail view additionally shows the green “Release” button.
• “Published”: the analysis counts as methodologically binding. Only now does the “Answer” button appear, which is where the specific assessment is entered.
• “Archived”: the analysis is no longer actively used but remains available as evidence.
• Whether a released analysis has already been assessed is shown in the “Last reply on” column. Empty values in that column are your backlog.

To move several analyses to “Published” at once, select them using the selection boxes at the beginning of each line and choose “Share” under “Actions” at the top right.

Two tips from practice: use the “All my organizations” button at the top right to switch to a single organization when you only want to review its risk analyses — a significant gain in clarity for group structures. And use the “Preview” as a final check before every release: events without assigned criteria, damage items without criteria, or risk levels with overlapping threshold values become noticeable much more quickly in the rendered form than in the individual input fields.