intuitem / ciso-assistant-community

CISO Assistant is a one-stop-shop for GRC, covering Risk, AppSec and Audit Management and supporting +37 frameworks worldwide: NIST CSF, ISO 27001, SOC2, CIS, PCI DSS, NIS2, CMMC, PSPF, GDPR, HIPAA, Essential Eight, NYDFS-500, DORA, NIST AI RMF, 800-53, 800-171, CyFun, CJIS, AirCyber and so much more
https://intuitem.com
GNU Affero General Public License v3.0
400 stars 60 forks source link

Critical risk matrix 4x4 request #337

Closed grov closed 2 weeks ago

grov commented 2 weeks ago

Request statement My Risk framework is based on a Risk Matrix 4x4. Is it possible to add a 4x4 risk matrix in the library ?

With the following legend example :

Thank you very much !

ab-smith commented 2 weeks ago

Hey, sure, you can get some inspiration from the libraries folder in the libraries folder and definitely have that. You can also share a screenshot and we'll pick it up later next week.

grov commented 2 weeks ago

Thank you it was easier than expected ! Here is the code if needed :

urn: urn:intuitem:risk:library:critical_risk_matrix_4x4
locale: en
ref_id: critical_4x4
name: Critical risk matrix 4x4
description: Critical risk matrix 4x4
version: 1
provider: intuitem
packager: intuitem
objects:
  risk_matrix:
    - urn: urn:intuitem:risk:matrix:critical_risk_matrix_4x4
      ref_id: critical_4x4
      name: critical 4x4
      description: critical risk matrix 4x4
      probability:
        - abbreviation: UL
          name: Unlikely
          description: Very unfrequent event
        - abbreviation: P
          name: Possible
          description: Unfrequent event
        - abbreviation: L
          name: Likely
          description: Frequent
        - abbreviation: H
          name: High
          description: Frequent or permanent
      impact:
        - abbreviation: MN
          name: Minor
          description: Minor impact
        - abbreviation: MD
          name: Moderate
          description: Moderate impact
        - abbreviation: S
          name: Significant
          description: Significant impact
        - abbreviation: MJ
          name: Major
          description: Major impact
      risk:
        - abbreviation: MN
          name: Minor
          description: negligible risk
          hexcolor: "#BBF7D0"
        - abbreviation: MD
          name: Moderate
          description: risk requiring mitigation within 2 years
          hexcolor: "#FEF08A"
        - abbreviation: S
          name: Significant
          description: risk requiring mitigation within 6 months
          hexcolor: "#FBBF24"
        - abbreviation: MJ
          name: Major
          description: unacceptable risk
          hexcolor: "#F87171"
      grid:
        - - 0
          - 0
          - 0
          - 1
        - - 0
          - 1
          - 1
          - 2
        - - 0
          - 1
          - 2
          - 3
        - - 1
          - 2
          - 3
          - 3

With Screenshot : critical_risk_matrix_4x4