Risk management
Maintain a risk register and model threat-based risk assessments in Probo
Probo supports two related ways to reason about risk: a risk register for tracked business or security risks, and structured risk assessments for modeling systems, threats, scenarios, and their resulting risks.
Risk register
Section titled “Risk register”A risk record describes a risk, its current state, and the context needed to evaluate it. Risks can be linked to:
- measures that reduce or monitor the risk;
- obligations that make treatment necessary;
- third-party assessments that identify vendor exposure;
- risk-assessment scenarios that explain how the risk may occur.
Keep the risk statement understandable without relying on a score alone. Record the affected activity or asset, the undesirable event, and the likely consequence.
Threat-based assessments
Section titled “Threat-based assessments”A risk assessment can contain scopes, nodes, boundaries, processes, threats, and scenarios. Scenarios connect threats to one or more risks and make the assessment’s reasoning reviewable. Scope diagrams can be exported as Mermaid for use in technical review.
Assessments and register entries have separate lifecycles: the assessment documents analysis, while linked risks are the items the organization tracks and treats over time.
Publication and review
Section titled “Publication and review”Publishing risk records creates a reviewed list without preventing continued program operation. Revisit risks when systems, vendors, controls, or business assumptions change. Use measures and tasks for treatment work instead of placing implementation details only in the risk description.