Asset & risk management depth
How this is scored
The ISMS core: asset inventory, risk methodology (identification, assessment, treatment), protection-needs inheritance, incident handling with statutory clocks.
0 — No ISMS substance; "information security" is a chapter in the marketing site.
3 — A flat risk list and an asset spreadsheet import; no treatment tracking, no inheritance, incidents live in the ticket system.
5 — Asset and risk management with configurable matrices and treatment tracking; basic incident handling; inheritance and aggregation need manual work.
8 — A real risk backbone: documented methodology (ISO 27005 or equivalent), inherited protection needs across asset relations, incident workflows with statutory reporting clocks (NIS2 24h/72h), risk acceptance with ownership.
10 — Risk management a certifier works inside: complete asset-risk-treatment chain with inheritance, continuity planning, incident reporting with authority export, and risk reporting the executive level actually reads.
The Lead Auditor
Assets carry CIA classifications, the risk lifecycle, fields and workflows are configurable per business unit, and treatments sit in a register natively linked to Annex A controls with AI drafting risks from incidents and vendor findings. Incident workflows log, triage and escalate, but I found no public information on protection-needs inheritance across asset relations, a named methodology such as ISO 27005, or statutory reporting clocks — the 72-hour figure in the terms is a contractual breach notice between the parties, not an authority clock. That places this solidly above the mid anchor and well short of the backbone a certifier works inside. 5 6 8 2