Workspace
Risk and Control Catalogue
Log architecture risks, map them to controls, and visualise the residual risk landscape so governance boards can see what is and is not mitigated.
Phase D, Technology ArchitectureDerived from TOGAF
Each row is one risk scored for likelihood and impact to give an inherent rating, with the residual column showing what is left once the mapped control is in place and working.
Where inherent risk is high and residual is still high, the control is not yet doing its job. Where residual drops to low, the control is working and the risk sits within appetite.
The heatmap holds eight risks; names take up to 26 characters.
Name and score the risks and the residual posture appears here: how the register stands after controls and what to fix first.