Clause 6.1
Actions to Address Risks and Opportunities
RiskSphere implements the risk-assessment and risk-treatment processes required by ISO 27001:2022 Clauses 6.1.2 and 6.1.3.
Enterprise Risk Platform
RiskSphere
Real Risk Management, Not Just a SpreadsheetRiskSphere turns risk assessment from a tedious annual exercise into a continuous risk-management program that genuinely protects your business.
RiskSphere
- Comprehensive Risk Register
- Risk Assessment Matrix & Heatmap
- Treatment Plan & Tracking
- ISO 27001 & NIST CSF Frameworks
$4.45M
Average cost of a data breach globally
Source: IBM Cost of a Data Breach 2023
287 days
Average time to identify and contain a breach
Unmanaged risk = a long window of exposure
83%
Of organizations have experienced more than one data breach
Source: IBM Security 2023
A Risk Register in a Spreadsheet Isn't Enough
Many companies have a risk register — but it lives in a spreadsheet updated once a year ahead of an audit. That isn't risk management; it's cosmetic documentation.
Risk evolves every day: new vendors join, new systems are deployed, teams grow. A static risk register doesn't reflect the threats your business actually faces today.
ISO 27001:2022 Clause 6.1 requires a systematic, repeatable risk-assessment process. RiskSphere automates this cycle so your team focuses on mitigation, not administration.
How RiskSphere Works
A simple, structured process your team can run right away.
- 01
Identify & Record Risks
Log new risks with full context: affected assets, threat sources, exploited vulnerabilities, and the potential impact on the business.
- 02
Assess: Likelihood × Impact
Rate every risk using a matrix configured to your company's standard. The system calculates the inherent risk score and plots the risk on a heatmap automatically.
- 03
Define the Treatment Plan
Choose a treatment strategy: mitigate, accept, transfer, or avoid. Assign an owner, deadlines, and implementation milestones that can be tracked in real time.
- 04
Implement & Track Controls
Track the implementation progress of the chosen security controls. Every status change is recorded automatically in the audit trail with a timestamp and the name of who made it.
- 05
Periodic Review & Residual Risk
Run scheduled risk reviews. RiskSphere calculates residual risk after controls are applied and shows how the organization's risk profile trends over time.
Features & Capabilities
Built to meet real operational needs — not just a checklist of features that look good in a brochure.
Compliance & Supported Standards
RiskSphere is designed to help your organization meet the relevant control requirements and information-security standards.
A.5.7
Threat Intelligence
Supports the collection and analysis of relevant threat information to update risk assessments on a regular basis.
NIST CSF
Identify — Risk Assessment
Aligned with the Identify function of the NIST Cybersecurity Framework, specifically the Risk Assessment (ID.RA) category.
OJK POJK 11
Banking IT Risk Management
Supports IT risk-management requirements under OJK regulations for the banking and financial sector.
Service Level Agreement (SLA)
The following SLAs apply to all RiskSphere Customers and form part of the mutually signed Service Agreement. All Customers receive full access to every platform feature.
* All SLAs are measured monthly and apply from the subscription activation date.
Who Needs RiskSphere?
This platform is designed to address the real pain points of different roles across the organization.
Frequently Asked Questions
Still have questions about RiskSphere? Reach out to our team via the contact page or the footer.
How is RiskSphere different from an ordinary spreadsheet risk register?
A spreadsheet risk register is a static document that quickly goes stale and is hard to manage collaboratively. RiskSphere is a dynamic system — every change is saved in real time, approval workflows and notifications run automatically, and the audit trail records every modification. Dashboards and reports can be generated at any time without rebuilding the data by hand.
Does RiskSphere support custom risk-assessment methodologies?
Yes. Although RiskSphere ships with ready-to-use ISO 27001 and NIST templates, you can adjust the rating scales, likelihood and impact criteria, and scoring weights to match your organization's business context and risk-management policy.
Can several departments use RiskSphere at the same time?
Absolutely. RiskSphere supports multiple departments with role-based access control. IT, compliance, operations, and management teams can access the relevant areas with permissions appropriate to their roles.
How does RiskSphere help during an ISO 27001 audit?
RiskSphere produces a draft Statement of Applicability (SoA), risk treatment plan, residual-risk reports, and review history — the key evidence auditors request for Clause 6.1. These documents can be exported in a ready-to-submit format.
Is our risk data secure in RiskSphere?
Data is stored with encryption at rest and in transit. Access is controlled with multi-factor authentication and an audit log that records every access and change. Our infrastructure is hosted in ISO 27001-certified data centres.
Ready to Try RiskSphere?
Schedule a free demo and see firsthand how RiskSphere can simplify enterprise risk platform in your organization.