Managing Hidden Risks with Entity Graphs 📊

A process can look perfectly harmless if you look at it at itself, but it runs on a system.

The system is hosted by a supplier, the supplier has a sub processor and somewhere further down that chain sits a risk that you never assist on the process itself.

And that's the kind of risk that almost impossible to spot in a spreadsheet because a spreadsheet has rows and reality has connections.

In .legal we try to visualize this and it looks like this in the platform.

Here's the platform and I'm right now on my NIS2 risk area.

This, this is my risk overview as now and I have some risk here and three risk over appetite and such.

But I do also have this number four linked risk over appetite.

And what does that mean?

I can click into it and then I will get a list and this list represent two legal entities and two assets which have its own risk here on low and moderate , which for us is okay in this area but they have high linked risk which is above our appetite.

So how can I look into this?

For instance the hosting database, it's interesting to look at.

It's have a moderate risk but what is linked to it which has a high risk.

Here I can select my entity graph and this will give you an overview.

You will have in this example your hosting database we're looking at and you can see that this is used in a process.

It is also linked to several other assets.

So all these assets has a link to our hosting database and there's a supplier and in this example the supplier have a high risk.

So, so if you look at the supplier then this will be linked up to the hosting database and you maybe need to be aware of the hosting database risk in terms of this supplier risk.

Of course I can navigate to the supplier now I will find the vendor itself and I can see it have a high risk navigate to that.

I already have a mitigation plan which means if this mitigation plan was implemented on the supplier then I would be able to make an entity graph where the link risk would be lower and in that way I could lower the number of lead risk over appetite.