Skip to main content
Under Administration › ISMS you set the review periods per criticality. How the page saves is described under General, Saving the Settings Pages.

​
Risk Review

One field each for Critical, High, Medium, and Low: the days until the next review is due, per criticality.
Unlike the ITAM validation cycle, these fields cannot be emptied — a review cycle always exists.
What the periods mean in the workflow is described under Risk Management Fundamentals.
The Risk Matrix is not set here — it applies beyond ISMS and is set under General.