Skip to main content

​
Risk assessment

The risk matrix axis labels for values 1 through 5: Risk levels: Low, Medium, High, Critical.

​
Treatment strategies

​
Control priority

Low, Medium, High, Critical.

​
Control status

Open, Planned, In Progress, Implemented.

​
Evidence effectiveness

Effective, Partially Effective, Ineffective.

​
Control category

Docusnap365 provides the categories; they appear in the interface language.

​
Recurrence units

Days, Weeks, Months, Years. With an interval of 1, a single adverb for the unit appears instead of “Every 1 month”.

​
Framework types

Standard, Law, Catalog, Custom.

​
Objective status

Pending, Not implemented, Partial, Complete, Not Applicable.

​
Terms

Threat — An event that can cause harm. Vulnerability — A gap that makes the event possible. Scenario — The combination of at least one threat and at least one vulnerability in a risk. Risk assessment — The product of likelihood and impact. Risk reduction — The difference between the current and target assessment. A positive value means the risk goes down; the display then reads Risk Reduction, Risk Increase with a higher target, or No Change with an equal value. Protection need — The highest of the three levels of Confidentiality, Integrity, and Availability for an asset (the Maximum Principle). Owner / Responsible — The person accountable for a risk, a control, or an asset’s protection need. Docusnap365 uses Owner on the risk and Responsible on the control and in the asset’s ISMS tab. Recurrence — Whether a control is carried out once or repeatedly. Evidence — The record of a control’s execution, with effectiveness and result. Framework — The umbrella term for anything compliance is measured against: a standard, law, catalog, or custom framework. Objective — The individual, assessable item of a framework. Only the leaves of the objective tree are assessable; every objective has a detail page of its own. Gap — An applicable objective that is not fully implemented, unconfirmed objectives included. The Gaps KPI carries the subtitle Applicable, not fully implemented. Review — The recurring check on a risk, a control, or a framework’s objective.