🎯 Risk Management in Brainframe

"One flexible risk engine — configure it to your methodology, let AI accelerate discovery, and watch your risk reduction trend over time."
Brainframe's risk management is fully customizable per purpose (CIA, legal, supplier, and more), so you can run ISO 27005, EBIOS RM, NIST, or your own in-house method — all in the same workspace.

Risk management in Brainframe is built around configurable risk types. Each risk type is its own methodology: its matrix, scales, measures, formula, appetite levels, and vocabulary. Because everything is configurable, the same platform supports many recognised frameworks side by side:

• ISO/IEC 27005 — asset/threat/vulnerability driven, CIA impact
• EBIOS RM — feared events and severity/likelihood scales
• NIST SP 800-30, ISO 31000, FAIR-style value scoring
• Sector or in-house methods — legal risk, supplier/third-party risk, operational risk, safety, privacy

You are not locked into one model. You define as many risk types as you need, each aligned to a specific purpose.

💡 A risk type in Brainframe = a complete, self-contained risk methodology (matrix + measures + formula + appetite + vocabulary + guidance). This guide uses "risk type" and "methodology" interchangeably.

⚙️ Section 1 — Configuration

All risk methodology settings live under Workspace Settings → Risk types (each risk type opens in the risk type / KPI editor). Below is everything you can configure.

1.1 Multiple Risk Types — One per Purpose

Create a distinct risk type for each risk domain you manage:

Each risk type has its own matrix, scales, and vocabulary, so a supplier risk and a CIA risk can be scored completely differently while living in the same workspace.

1.2 Matrix Size and Scale

Choose the risk matrix dimensions — 3×3, 4×4, 5×5, or 10×10.

📌 Changing the scale does not affect existing risk readings. Readings are re-normalised to the new matrix scale. If you need a scale we do not offer yet, contact us.

1.3 Sequential vs Multiplication Cell Values

Choose how each matrix cell's value is derived:

1.4 Configurable Measures (e.g. C, I, A, P)

Measures are the axes' building blocks. For a CIA methodology you might define Confidentiality, Integrity, Availability, and Probability; for EBIOS you might define Severity and Likelihood with custom levels.

For each measure you configure:

• Title (e.g. Confidentiality, Impact, Likelihood)
• Type — Range (0–5), Number, Yes/No, or Percentage
• Value list — the selectable levels with custom labels and ranges so they align exactly with your existing methodology (e.g. "Negligible / Minor / Moderate / Major / Catastrophic")

This lets you reproduce the precise wording and level count of ISO 27005, EBIOS, or your internal scale.

1.5 Formula & X/Y Positioning (Value / Min / Max / Product)

You define which measures drive the X (likelihood) axis and which drive the Y (impact) axis, and how they combine. The formula type determines positioning:

Normalization across different ranges

When measures have different ranges (e.g. one is 0–5, another 0–100), Brainframe normalizes the combined result to fit the matrix size. For Product, the minimum and maximum possible values of the selectable measures are used as the normalization range, so the position always maps correctly onto your chosen 3×3 / 5×5 / 10×10 grid.

1.6 Risk Appetite Levels

Configure the appetite bands shown as coloured zones on the matrix. Each level (typically Green / Yellow / Red / Black, extensible to Blue / White) supports:

• Custom label (e.g. "Acceptable", "Tolerable", "Unacceptable") — and whether the label is shown
• Configurable colour
• Threshold range (the minimum cell value where the band starts)
• Review frequency — how often risks in that band must be re-reviewed

Review frequencies that notify owners

Each appetite band has a review frequency (1–24 months). Risks sitting in a higher-severity band are scheduled for more frequent review, and owners are notified when a review becomes due — so critical risks never go stale.

1.7 Configurable Methodology Text (used by AI)

Each risk type has a rich methodology description (HTML). This text:

• Documents how the methodology should be applied for readers and auditors
• Is used by AI to guide risk identification and scoring in the wizards, keeping AI suggestions aligned with your chosen method (ISO 27005, EBIOS, etc.)

1.8 Default Document Type & Template

Set the default risk document type and its template for this risk type. When a new risk is created for this methodology, it starts from the right structure (description, causes, consequences, treatment) automatically.

1.9 Link to Process Kanban

A risk type can be linked to a process kanban board so that remaining work is tracked as workflow stages. This connects risk treatment progress to Brainframe's task/process system (Todo → Doing → Done), keeping mitigation execution visible.

1.10 Asset Impact / Consequence Configuration

Beyond the matrix, each risk type defines the impact/consequence dimensions used when assessing assets — for example Reputation, Operational, Legal, Financial, Personal. For each consequence you configure:

• Title and order
• Guidance / methodology description

These consequences and their guidance texts are shown on the Governance tab / Dependencies tab of documents, where you set an asset's or supplier's maximum impact. Those max impacts then feed asset & control risk readings as upper bounds.

1.11 Control Register

Define a control register — a structured vocabulary of potential controls to consider when evaluating risks. Organised by category, it can be edited manually, imported from text/JSON, or AI-assisted.

The register gives the AI a curated list of relevant controls to propose during risk assessment, so suggestions match your framework's control catalogue rather than generic guesses.

1.12 Risk Register

Define a risk register — a structured vocabulary of potential risks / threats to consider. Like the control register, it is grouped by category and used to steer the AI toward the risk scenarios relevant to your methodology (e.g. EBIOS feared events, ISO 27005 threat catalogue).

1.13 Mandatory & Optional Tags (Risk reading properties)

Configure the document properties (tags) collected during risk readings — marking each mandatory or optional. Common examples:

• Origin (where the risk comes from)
• Risk type / category
• Risk action / treatment decision (mitigate, accept, transfer, avoid)
• Any custom field your programme requires

Mandatory tags are enforced when saving a reading, ensuring consistent, audit-ready risk records.

🧭 Section 2 — Risk Management

2.1 Bulk Import of Risks (from Excel)

Migrating from spreadsheets? The bulk import tool (from a folder / table view) turns an existing Excel file into governed Brainframe risk documents.

The wizard walks through staged steps:

1. Upload — drop your Excel (or ZIP) file
2. Map content — map spreadsheet columns into the risk document template (e.g. description, causes, mitigations, owner) so each row becomes a fully documented risk
3. Variables — map any reusable template variables
4. Risks — optionally perform a direct risk reading during import, taking the impact/likelihood values straight from Excel columns so risks land on the matrix immediately with their score
5. Validate & Import — review and create all documents in one go

This means you can import not just the narrative (description, mitigations) but also the initial risk position from your existing register — no manual re-scoring.

2.2 The Two Risk Wizards (AI-assisted)

Brainframe provides two AI wizards that share the same goal: quickly identify and document risks, mapped to your existing assets and controls, using your configured registers and methodology.

🏗 New Asset Wizard

Launched when creating/onboarding an asset (Create asset wizard). It:

1. Captures the asset details (AI-assisted description)
2. Pulls in existing controls and risks already in the workspace and maps them to the asset
3. Uses the risk register to identify compliance / control risks (gaps)
4. Builds a mitigation plan (missing controls + optional linked plan document)

🎯 Risk Assessment Wizard

Launched from the risk matrix. It lets you select one or more existing assets (e.g. core business services) and then runs the same AI-assisted flow across all of them: map existing controls/risks, identify new risks from the register, and propose a combined mitigation plan.

Both wizards aim to get you from "blank register" to "documented, scored, mitigated risks" fast — with AI grounded in your methodology text and registers.

2.3 Where Risk Readings Happen

A risk reading (a scored assessment against a risk type) can be added to any document — an asset, supplier, employee, process, etc. This is powerful for quick, in-context scoring.

However, best practice (and what the wizards create) is a dedicated risk document that:

• Describes the risk (scenario, causes, consequences)
• Is linked to the related assets it affects and the controls that mitigate it
• Carries the risk reading itself

Because the reading is on the risk document, that risk then appears on the relevant risk type matrix, and its evolution across successive readings is visible on the document's Risk tab.

2.4 The Add Risk Reading Screen

The reading screen has several core sections:

Remaining work (the Brainframe differentiator)

Each reading records a remaining work level that expresses how much of the treatment is done — from not started to fully mitigated/accepted:

This drives the remaining-work colour of each risk on the matrix and the remaining-work trend chart (Section 3).

📈 Section 3 — Viewing Risk & Evolution

3.1 Table View — Risk Readings in Context

In any table view, as soon as at least one item has a risk reading, its reading is shown inline (impact, likelihood, final result, remaining work, reading date, measures, target, deadline).

• Filter quickly by risk owner, criticality, and other document properties
• Export the visible risk data to Excel for reporting

3.2 Risk Matrix Module

Open Risks → Risk matrix. First select the risk type — the whole view reflects that methodology's matrix, appetite, and colours.

Summary cards

Above the matrix you get an at-a-glance overview:

• Severity distribution of risks
• Remaining work status
• Planned mitigation status

The risk matrix visualization

The matrix shows:

• Appetite ranges as coloured background zones (your configured colours and labels)
• Individual current risk readings plotted on their cell, each marker coloured by its remaining work:
• ⬛ Black = nothing done → counts as risk × 5 (full remaining work)
• ✅ Green = fully mitigated or accepted → counts as risk × 0 (no remaining work)
• intermediate colours for in-progress treatment

Hover over any risk marker to see its Initial / Current / Target risk positions together.

Remaining-work & risk-reduction trend

Below the matrix, a trend chart aggregates all risks over time:

• Orange — remaining work / risk reduction trend (how the outstanding risk is coming down)
• Blue — newly added risks
• Green — all planned risks

The deadline set on a risk's Planning tab is treated as the date by which the risk should be maximally reduced or accepted — i.e. risk × 0 for remaining work. Reaching that point means the risk is fully managed, not that it has disappeared.

Export

Below the trend you can export all risk readings, or just the latest reading per risk, for quick Excel reporting.

3.3 Per-Document Risk Evolution (Risk tab)

Open an individual risk document → Risk tab. Here you can visualize every reading done for that risk over time, seeing how Initial → Current → Target evolved with each assessment and how remaining work progressed.

Putting It Together

1. Configure a risk type per purpose (CIA, legal, supplier…) — matrix, measures, formula, appetite, registers, methodology, tags.
2. Create risks — bulk import from Excel, or use the AI wizards to identify and document them against your assets and controls.
3. Score with risk readings (initial / current / target + remaining work).
4. Monitor on the matrix, trend chart, table view, and per-document Risk tab — and let review frequencies keep owners on track.

Because every layer is configurable, Brainframe adapts to ISO 27005, EBIOS RM, NIST, ISO 31000, or your own methodology — without changing tools.

For the assets and suppliers that risks attach to, see the Asset Management and Supplier & Third-Party Management guides.

Updated on: 13/07/2026