ISMS Risk Management Kit

Risk criteria and score-only bands, acceptance authority, criteria for assessments, event or asset-based steps, calibration, treatment, outputs, size tiers, AI variant

Appetite and tolerance per category, criteria for performing assessments, 5x5 scales (C, I, A, financial, legal, reputation, OT safety), bands, approvals

12 threat sources, 24 threat events and 18 vulnerabilities linked to Annex A controls and ATT&CK v20 tactics, scenario building, OT entries, update route

Information and associated asset register: roles, C0 to C3 classification, CIA scale, fields, discovery and reconciliation, lifecycle, size tiers, records, metrics

Risk register with appetite, catalogue refs, inherent and residual scores, Annex A controls, acceptance with expiry, status lifecycle, heat maps, feeds, size tiers

One cycle: scope, method refs, participants, results by band, current and residual heat maps, top risks, changes since last cycle, treatment hand-off

Treatment selection and Annex A comparison, actions with controls, budget and schedule, pending decisions, verification, SoA changes, owner approval and acceptance

All 93 Annex A controls with basis, justification, status, reference document (DOC-ISMS IDs) and evidence, exclusions, additional controls, size tiers, records

One record per accepted risk: scores before and after, rationale, compensating controls, conditions, expiry, approver per band, lifecycle, register

Policy exception and risk acceptance form: requirement not met, justification, inherent and residual risk, compensating controls, approver tiers, expiry, lifecycle