Asset & risk management depth
How this is scored
The ISMS core: asset inventory, risk methodology (identification, assessment, treatment), protection-needs inheritance, incident handling with statutory clocks.
0 — No ISMS substance; "information security" is a chapter in the marketing site.
3 — A flat risk list and an asset spreadsheet import; no treatment tracking, no inheritance, incidents live in the ticket system.
5 — Asset and risk management with configurable matrices and treatment tracking; basic incident handling; inheritance and aggregation need manual work.
8 — A real risk backbone: documented methodology (ISO 27005 or equivalent), inherited protection needs across asset relations, incident workflows with statutory reporting clocks (NIS2 24h/72h), risk acceptance with ownership.
10 — Risk management a certifier works inside: complete asset-risk-treatment chain with inheritance, continuity planning, incident reporting with authority export, and risk reporting the executive level actually reads.
The GRC Consultant
A real risk backbone rather than a checklist: protection-needs analysis at process level with automatic inheritance into the infrastructure, threat assessment, measure tracking with owners, deadlines and automatic notification, and incident handling that maps affected assets — all sitting on a CMDB that feeds itself from discovery tools. I found no public information on statutory reporting clocks such as NIS2 24h/72h workflows or formal risk acceptance with ownership, which the strongest products in this class show. 5 1 2