Back to the workshop
Idea

Risk Register

The risk register for your ISMS right in Confluence and Jira, instead of in a spreadsheet that only gets opened before the audit.

The problem

In practice, risk assessment under ISO 27001 often means an Excel list, updated once a year. The treatments run as tickets in Jira, the reasoning sits in Confluence. Only nothing is connected. Whether a risk has really been treated, nobody knows for sure.

What it does

  • Risks with likelihood, impact, owner and treatment decision. Rated by the method your policy specifies.
  • Treatments as Jira tickets, linked to the risk. When the ticket is done, the register shows it, and the residual risk is due for reassessment.
  • Review dates, change history and an export the auditor can read, referencing the Annex A controls.

Who it's for

ISMS owners who work in Confluence and Jira anyway and don't want to roll out a separate GRC tool.

Where things stand

Still an idea. It hangs on the same questions as AttestFlow and ClassMark. I'm currently collecting how risk registers are kept in practice and where they fail. If you keep one, tell me about it.

You keep a risk register and have an opinion about it?

Tell me about it