Risk Management and Mitigation Guide 🛡️

Identifying a risk is the easy part The hard part is deciding what to do about it.

Because at the moment when it's written down, you have taken a position, including if you do nothing at all.

There are three roads.

You can accept the risk, you can try to avoid it, or you can mitigate it.

In the .legal platform you can make an entire plan in terms of mitigating your risk from a, proposal to approved plan and until it's completed and implemented in your risk overview.

Let me just show you how.

Right now I'm in a risk area.

This is my NIS2 risk area.

And I can see that I have multiple high risk up here that I need to do something about.

I can of course select it here and figure out which specific entities that have this high risk.

But I can also see that up here I have three risk above appetite.

This little widget does also tell me that I have two without a treatment decision.

When I select this, I will get a list of all risks that are above appetite and where I don't have a mitigation plan.

Now I can select the given assets with the high risk and see where does the risk live.

In this example it's on this scenario.

In the right side I can now select different treatment planes.

I can accept the risk, I can avoid the risk, but I can also mitigate the risk.

So first of all the risk were made by me, I have assessed this, I gave it a consequence and a probability and then I got a risk score.

When I select mitigate I will do a, process that looks like that.

I'll give a name for the plane, how to downgrade, the risk and I can say what do I want to do?

Let's make a quick plan and then I can select for instance if I'm going to implement new security measures.

So I can select multiple here I can set a responsible who needs to carry it out and what should the deadline be for Anne in this example?

Then I can say after the mitigation I will have a new consequence and I will have a new probability and also set an amount.

What will it cost to implement this update and what would the financial exposure be afterwards?

let's just say 1.500 and then I can save my mitigation plane.

So what I can see now is that I have still have a high risk on this scenario, but I have a plan how to downgrade it to a very low risk.

If I navigate to my mitigation part up here, I will also be able to find the plan.

It will be present here.

And I can see that Anne has the responsibility and it's right now a proposed plane.

Then we can start the decision phase.

I could approve the plane, I could plan it and I can say Anne need to carry it out and I want to create a task and then save it.

Now this is a plan and I can go to my task management board as well and find in this month here a task to Anne that she need to mitigate this specific risk.

Then Anne can work within the task management and say it's ongoing and the end you can say it's completed.

The same plan will now be reflected in mitigation.

It's now marked as complete and I can see that Anne did it within time and now I have the possibility to apply this mitigation.

First of all, I will just show you that in the overview I still have this marked as a high risk, but I can see after mitigation how my risk overview will change in terms of the mitigations.

So right now I have two less risk up here and they have moved down to this area Then I can go back to my mitigation plans and now I can implement this.

So I will apply this mitigation select.

Yes, it's now applied, but it also means that my current risk level is now updated.

So now I only have two risk in the high level because I implemented my mitigation plan.

All of this can also be done in a bulk.

So if you have multiple risks on multiple similar entities with the same scenario, you can bulk mitigate, select them all and say I want to mitigate this specific risk scenario and then do multiple at once.