Integrated Enterprise Risk Management
The software’s risk analysis functionality enables unified support for various types of risk analysis within the enterprise. Risk analyses across multiple different areas — even of different risk analysis types — can run simultaneously, and their results can be managed in a unified manner, thereby implementing and supporting integrated enterprise-wide risk management (ERM).
- Information Security, NIS2, CER, DORA
- Vulnerability Assessment results
- Physical Security
- Data Security
- Business and Process-Based Risk Analysis
- Critical Organizations – Resilience Risk Analysis
- Human Resources
- Ad-hoc, Project-Based Risk Analyses
In the RISK module, multiple, independently manageable risk analyses can be launched simultaneously, each with its own designated managers and evaluators. These can be different types of risk analyses or separate risk assessments for different organizational units or business areas.
The scope of the various risk analyses can be flexibly configured in terms of threats and/or resources. As a result, comprehensive, partial, ad hoc, and project-based risk analyses can all be conducted.
Risk Analysis Methodology
- Multiple risk analysis methodologies can be configured; they are highly customizable and adaptable to companies’ existing methodologies during implementation
- Management of multiple risk assessments—for different areas, different methodologies, different scopes of resources, and different objectives.
- The risk analysis methodology and terminology used are aligned with those described in the ISO/IEC 27005 standard.
- Default standards and best practice settings for threats and vulnerabilities, impact scale templates.
- Critical entities, resilience risk analysis
- The interpretation of impacts and damages can be fully tailored to the specific needs of the organization (financial loss, reputational damage, operational disruption, legal consequences, personal injury, etc.). SeCube’s library of professional templates also provides predefined damage impact tables.
Business impact analysis
SeCube enables the preparation of a comprehensive Business Impact Analysis (BIA) by building on the established process, data, and IT service inventories, with the involvement of the business units. Designated business owners can evaluate assets based on the criteria of Confidentiality, Integrity, and Availability (CIA). The results of the BIA are integrated into the risk analysis process; however, they are not a prerequisite for the risk assessment process.
Risk analysis
Risk analysis links the vulnerabilities and protective measures of our assets to the threats they face. SeCube supports the modeling of cause-and-effect relationships in risk events, the analysis of expected business impacts, and the ongoing assessment and management of risks.
- Management of Threats, Vulnerabilities, and Mitigation Measures
The RISK module provides predefined catalogs of threats, vulnerabilities, and mitigation measures based on ISO, NIST, and other regulations, supplemented by KÜRT Zrt.’s practical experience and best practices. These can be expanded and customized according to the organization’s needs.
- Cause-and-effect propagation model and visualization.
SeCube uses a graph-based propagation model that supports tracking the consequences of threats, how they spread across interdependent resources, and what business consequences and losses, impacts they may lead to.
- Business Impact Assessment
Consequences (CIA or other business event categories) can be assigned to risks, and business impacts can be assigned to those consequences. The assessment is based on a standardized, customizable impact matrix and assessment dimensions (e.g., financial, legal, reputational, personal injury, etc.). Business impacts can be derived from the results of a separate Business Impact Analysis (BIA) assessment (Governance module) or assessed directly within the RISK module.
- Integration with Other Modules
Risk analysis also takes into account information from other modules, such as compliance results from the Compliance module, audit findings, incident log data, and other relevant information.
- Comprehensive Analyses and Reports
Risk lists and analytical reports, prioritized based on the results of the risk analysis, are generated to support informed decision-making and risk monitoring.
- Validation checks
Built-in validation functions continuously monitor changes in data, ensure that risk analyses remain up to date, and help maintain the consistency and reliability of results.
Integrated Risk Assessment and Ongoing Risk Management
The risks identified during the risk analysis can be evaluated using various analytical reports, and risk management decisions can be made. The system supports the simultaneous management of the results of multiple risk analyses, allowing them to be analyzed and compared either independently or in an integrated manner.
The risks identified during the risk analysis can be evaluated using various analytical reports, and risk management decisions can be made.
- The results of various risk analyses can be evaluated, compared, and managed separately or even in an integrated manner.
- Validation tests help ensure the consistency of the risks.
- Visualization of the spread of risks
- We can make risk management decisions, plan detailed risk management measures, and monitor them.
- Task management functions support the implementation of risk management measures, including assigned responsibilities, statuses, email notifications, and even time-series reports.
- Risk diagrams, with comparative reports organized by time period (current status, today’s status, and future statuses based on our risk management plans)
The purpose of risk management functions is to continuously support the organization’s risk-based protection and to provide an up-to-date overview of the current status of risks and related measures.
Risk Management Results
SeCube presents the results of risk analyses across various areas in a standardized, easy-to-understand format, making it easy to assess, manage, and monitor the organization’s risks. The generated reports and statements support the identification and tracking of necessary risk management measures.
As a result of the work performed in the software, audit-ready documentation can be generated at the click of a button:
- Prioritized risk list, with detailed analytical reports and graphical status distribution charts.
- Risk management charts that support the comparison of current and planned future states at the time of analysis.
- An automatically generated, detailed Risk Analysis Report.
- An integrated enterprise-wide risk overview that consolidates the results of multiple organizational units or analyses.
- Risk management plans, including actions to be taken and their status
