For organizations that want to delegate risk assessment work to asset owners, we have developed a feature: asset-based risk identification. Asset-based risk identification enables more detailed risk identification and focus on key assets.
How to turn on the asset-based risk identification
Organization dashboard -> Settings
You can enable the asset-based risk identification from account settings. When this is enabled, all assets matching with the selections will show a separate risk identification section on their cards.
From settings, you will also choose documentation where risk identification is active and the priority level, which sets a level when the identification needs to be done.
If you enable asset-based risk identification feature from settings, the selected asset's documentation cards will show a pending risk identification workflow.
How the asset-based risk identification is done
With the help of this workflow, asset owners identify detailed and relevant risks for this asset. Then they can continue normally forward with the risk workflow - straight from the asset's documentation card.
When document card has priority set to the accepted level, risk identification workflow will pop up to the documentation card.
When you press "start risk identification" a list of suggested threats with summaries is shown. Now, it's time to choose which of these risks are relevant in this case. You can also create custom risk, if something relevant is missing.
Only after you've gone through all the suggested risks, picked the relevant ones and clicked "not relevant" on the rest, you can click "Create selected risks" and move forward.
Now that relevant asset-based risks are identified, you can delegate risks to relevant owners and work on the risks on the risk card from asset's documentation card.
For admins: edit template
As an admin, you can customise the asset-based risk identification template to better suit your organisation's needs. The editing is done from the asset card, using the Edit template button. The customisation is theme-specific.
You can select the threats from the example library that are relevant to your organisation, as well as tailor your own personalised threats that your organisation should consider during the risk identification phase. Once the threat list has been tailored to fit your needs, finish customizing. In the future, asset-specific risk identification will be done with customised threats.
Questions and feedback
Do you have any further questions, would need another help article or would like to give some feedback? Please contact our team via team@cyberday.ai or the chat box in the right lower corner.
