Skip to main content
Under Administration › ISMS you set the review periods per criticality. How the page saves is described under General, Saving the Settings Pages.

​
Risk Review

One field each for Critical, High, Medium, and Low: the days until the next review is due, per criticality.
Unlike the ITAM validation cycle, these fields cannot be emptied—a review cycle always exists.
What the periods mean in the workflow is described under Risk Management Fundamentals.
The Risk Matrix is not set here—it applies beyond ISMS and is set under General.