Risks

What the screen is for#

The information security risk register: the level of each risk before and after treatment, the chosen response, and the Annex A controls that carry it. The ISO 27001 audit (6.1.2 and 6.1.3) expects a risk assessment and treatment that the Statement of Applicability can cite.

Who can do what#

Step by step#

Read the matrix and the map#

• "Matrix and appetite": the default matrix is 5 × 5. The score is likelihood multiplied by impact. The thresholds (medium, high, critical) and the appetite are shown. It cannot be changed yet.
• "Heat map of the open risks": one map "Inherent (before treatment)" and one "Residual (after treatment)". A risk whose rating falls outside the matrix is not placed, and the screen says so.
• Filter by "Status", "Residual level" and "Treatment".

Record a risk#

1. Click "Nouveau risque".
2. Fill in "The risk": "Title" (required), "Description", "Owner" (required).
3. Under "Assessment before treatment", choose the "Likelihood" (from "Very unlikely" to "Almost certain") and the "Impact" (from "Negligible" to "Critical"). The screen computes the "Inherent level".
4. Under "Treatment", choose the "Response to the risk": "Reduce", "Accept", "Transfer" or "Avoid". For "Mitigate", choose at least one Annex A control.
5. Enter the "Target residual level" (residual likelihood and impact). It cannot exceed the risk before treatment.
6. If the risk is accepted, or if its residual level stays above the appetite, fill in "Accepted by", "Date of acceptance" and "Justification".
7. Under "Follow-up", choose the "Statut": "Identified", "In treatment", "Treated", "Closed", the "Next review" and, if you wish, "Treatment in place before".
8. Click "Save". If a rule is not met, the "This risk cannot be saved" area says which.

Edit or close#

Click a risk in the list, edit, then "Enregistrer". "Clore le risque" closes it. If someone else changed the risk in the meantime, the screen offers "Reload the risk"; your input is then lost.

Link assets#

In the panel of a risk that is already saved, the assets section lets you search the inventory, choose the assets the risk affects (ISO 27001 6.1.2) and click "Save the assets". This save is separate from the form's: save the form first. Only compliance managers and Jira administrators can link assets. An asset whose object has gone from JSM Assets stays on the risk, marked "object not found"; it is linked again in the Assets tab.

Draft and assess with the assistant Edition: Advanced#

In a risk's form, the "Assistant" block offers two things. "Propose a draft" starts from one sentence you type ("an unencrypted laptop is stolen during a trip") and proposes the title, the threat, the vulnerability, the consequence, assets and controls. "Propose an assessment" starts from the title and the description and proposes the inherent likelihood and impact, a treatment (mitigate, transfer or avoid), controls, then the residual likelihood and impact, each with its reason. Fill in the risk's title first.

You tick the fields to take ("Take the selection"); nothing is saved before "Save". Assets are linked once the risk is saved. The assistant never proposes to accept a risk: accepting it is a person's decision, recorded in their name. What goes to the model: AI assistant.

Import risks#

"Import" and "Download the template" (for whoever edits risks) fill the register from an Excel workbook, with a preview before writing. Accepting a risk is not imported. See Import and export with Excel templates.

What the auditor will take from it#

A dated risk assessment, with owner, treatment, controls and acceptance. The risques.csv file of the audit pack and the heat maps in the report reproduce its content. Every creation, change and closure is in the audit log. An Annex A control that is excluded while an open risk relies on it blocks approval of the statement.

Known limits#

• The default matrix cannot be configured in the app yet.
• The register is "light". A risk's assets are linked by hand: no link is inferred automatically.
• Inactive or unfound accounts can be neither owners nor acceptors.
• The owner of a risk neither accepts it nor records its acceptance: the save is refused with "The author cannot approve their own work". An administrator may, and the log says so.