Asset & risk management depth
How this is scored
The ISMS core: asset inventory, risk methodology (identification, assessment, treatment), protection-needs inheritance, incident handling with statutory clocks.
0 — No ISMS substance; "information security" is a chapter in the marketing site.
3 — A flat risk list and an asset spreadsheet import; no treatment tracking, no inheritance, incidents live in the ticket system.
5 — Asset and risk management with configurable matrices and treatment tracking; basic incident handling; inheritance and aggregation need manual work.
8 — A real risk backbone: documented methodology (ISO 27005 or equivalent), inherited protection needs across asset relations, incident workflows with statutory reporting clocks (NIS2 24h/72h), risk acceptance with ownership.
10 — Risk management a certifier works inside: complete asset-risk-treatment chain with inheritance, continuity planning, incident reporting with authority export, and risk reporting the executive level actually reads.
The Skeptic
A "Dynamic Risk Register & Treatment" clears the flat-list bar, but nothing in the evidence evidences an asset inventory, a documented risk methodology, inherited protection needs, or incident workflows with statutory clocks — the only 24-hour figure on record is the vendor's own privacy-policy promise, not a product feature. The supply-chain module gestures at third-party risk; the ISMS core stops at register-plus-treatment. 2 5 1