Asset & risk management depth
How this is scored
The ISMS core: asset inventory, risk methodology (identification, assessment, treatment), protection-needs inheritance, incident handling with statutory clocks.
0 — No ISMS substance; "information security" is a chapter in the marketing site.
3 — A flat risk list and an asset spreadsheet import; no treatment tracking, no inheritance, incidents live in the ticket system.
5 — Asset and risk management with configurable matrices and treatment tracking; basic incident handling; inheritance and aggregation need manual work.
8 — A real risk backbone: documented methodology (ISO 27005 or equivalent), inherited protection needs across asset relations, incident workflows with statutory reporting clocks (NIS2 24h/72h), risk acceptance with ownership.
10 — Risk management a certifier works inside: complete asset-risk-treatment chain with inheritance, continuity planning, incident reporting with authority export, and risk reporting the executive level actually reads.
The Lead Auditor
A "Dynamic Risk Register & Treatment" and "automated risk assessments" clear the flat-list bar, but the evidence evidences no asset inventory, no risk methodology, no protection-needs inheritance and no incident workflows with statutory clocks — the only 24h figure is the vendor's own breach promise about itself. That is a register with treatment tracking and nothing behind it a certifier can trace. 2 5 1