Skip to main content

Risk Measures

A risk measure is the work a security risk's treatment actually consists of. Each belongs to one risk and has its own flow, so it can be assigned and tracked while the risk waits.

The flow​

StateMeaning
DraftBeing defined, or being corrected after a rejected performance.
In progressSomebody is carrying it out.
In progress approvalWhat was done is with the approver.
ClosedDone, or given up. Either way the risk stops waiting on it.

Fields​

  • Code / Name — the measure's identity.
  • Description and definition — what is to be done.
  • Annex A control — which control this measure implements. See below.
  • Responsible — a single user. See below.
  • Planned start date / planned end date — the commitment.
  • Actual end date — stamped when the measure closes, never typed.
  • Perform information — the account of what was actually done.
  • Attachments — planning material.
  • Perform attachments — the evidence of completion.

The measure names an Annex A control​

This is the one thing this module changes about a measure. Where a safety measure records a control hierarchy level — elimination through PPE — a security measure records which ISO 27001 Annex A control it implements.

That is what connects the work back to the standard. A measure implementing A.8.8 Management of technical vulnerabilities is evidence for that control on the Statement of Applicability, and the connection is the record rather than a coincidence of wording.

tip

Name the control the measure genuinely implements, not the one it is loosely related to. The statement's implementation status is read off these measures, so a measure filed under the wrong control makes two lines wrong at once — one that looks implemented and one that looks untouched.

The responsible is one person​

Everywhere else in the module the responsible is a collection of identities — users, roles, positions, organization units. A measure is the deliberate exception: it names a single user.

A measure is concrete, short-lived and taken on by one person, and both of its task steps resolve their assignee from that field. A collection here would leave "who is doing this" unanswerable at exactly the point it needs an answer.

A measure may only be opened against a waiting risk​

A measure can only be created against a risk that is waiting for measures — which in practice means from the control step, as it is being completed.

Two situations are refused:

  • Opening a measure against a draft risk, or one still in approval.
  • Opening one against a risk whose treatment needs no measures.

Both would produce work with no flow to return to.

Closing the last measure releases the risk​

When the last outstanding measure closes, the risk moves on from waiting for measures — pushed from the measure itself, immediately, not found by a periodic scan.

note

Outstanding work counts nonconformities too. The check counts both the measures and any CAPA records raised against the risk, so a risk does not walk on while either is still open.

Dates are stamped, not typed​

The completion date is stamped when the closing approval is given. There is no field for it on the form where a measure is defined — it appears on the performance panel and on the read screens.

That way the date always records when the work was actually accepted, rather than when somebody said it was.

Where measures appear on the risk​

The risk's control step carries its measures as a panel of cards rather than a grid. A risk has few enough measures that a table's header, pager and horizontal scroll read as heavier than what they hold — and the panel sits inside a form, where a second grid competes with the fields around it.

Each card shows the dates and the account of the work. A measure opens in a modal over the risk, and the panel refreshes from the measures rather than re-reading the risk — re-reading it would discard scoring the assessor has typed and not yet saved.

The panel is hidden when measure not required is set on the risk.

Creating a measure​

  1. Open the risk at its control step.
  2. In the measures panel, choose New. The measure opens in a modal.
  3. Write the definition — what is to be done.
  4. Name the Annex A control this implements.
  5. Name the responsible — one person.
  6. Set the planned start and end dates.
  7. Save and send it on. The measure is created and advanced in one action.
note

A measure is created and advanced in a single action rather than by a plain save. This is why a measure cannot be created by an ordinary OK button — the create step and the first transition happen together.

Cancelling a measure​

Closing a measure without completing it stops the risk waiting on it without claiming the work was done. The verification step is where somebody judges whether what remains was enough — and if it was not, the risk goes back to the control step where a new measure can be opened.