{"catalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","download":{"releaseId":"sha256:2e7f287319578efa3dfa7a4d0ff29b9a8e99dd84c8d54178f3a45d53c6e3afdd","slug":"controls-isms-risk-assessment-treatment","url":"/controls/assets/agent_workflow-controls-isms-risk-assessment-treatment-f2b61b25.373ebf3061020721.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"monitor"},"canonicalUrl":"https://assureswarm.com/workflows/all/?w=controls-isms-risk-assessment-treatment","description":"Perform an ISO 27005 information security risk assessment and treatment cycle for a defined ISMS scope. The recurring cycle instance attaches to the existing Process item (process_type=security_process) that represents the ISMS scope — enrich that item, never create a duplicate; the risk register it produces is the set of Risk items the run creates and updates. The cycle: establish context and risk criteria, identify information security risks, analyze and evaluate them against the criteria, select treatment options, draft the risk treatment plan, obtain residual-risk acceptance, and retain the documented information. In scope: risk identification through treatment planning and residual-risk acceptance for the ISMS boundary. Out of scope: the Statement of Applicability control-applicability determination and control operating-effectiveness testing, which are handled downstream. This workflow has no upstream workflow — its boundary and inventory are initial inputs: the in-scope business processes are existing Process items, while the asset/information inventory and risk criteria are uploaded documents (no native Asset type). It produces the named deliverables — the current risk register (Risk items), the Risk Treatment Plan (RTP), and the SoA inputs — handed off to the ISO 27001 SoA Review & Controls Assessment workflow.","details":{"canonicalUrl":"https://assureswarm.com/workflows/all/?w=controls-isms-risk-assessment-treatment","capabilities":[],"controls":["UC-RISK-06","UC-RISK-07","UC-RISK-08","UC-RISK-09","UC-RISK-10","UC-RISK-04"],"domains":["controls"],"lineOfDefense":"monitor","mappingStatus":"mapped","releaseId":"sha256:2e7f287319578efa3dfa7a4d0ff29b9a8e99dd84c8d54178f3a45d53c6e3afdd","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-isms-risk-assessment-treatment","standards":["iso-27001","iso-31000"],"teams":["it","risk-management"]},"id":"wf:C6","mapUrl":"https://assureswarm.com/controls/?v=1&node=wf%3AC6","slug":"controls-isms-risk-assessment-treatment","sourceIds":["coso-erm","coso-ic","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"ISMS Risk Assessment & Treatment Cycle","type":"workflow"},"relationships":[{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:2028cc99a0faefa3e71e30dcb3372dd81b608377cecc55d7e30ec0590c4f6701","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-c6-8bc75783.json","sourceId":"wf:C6","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-09-06ffdff1.json","targetId":"uc:UC-RISK-09","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:8461aa050063bfa1265d5de82cb69a2820618826d9fe77880a71eb8973821224","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-c6-8bc75783.json","sourceId":"wf:C6","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:9b6a2cc1f3f56a47371fc3a69397c2773b0c7b908137a3dd9ca5316995d684ad","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-c6-8bc75783.json","sourceId":"wf:C6","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-07-b86de728.json","targetId":"uc:UC-RISK-07","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:b233b5a5f41b5a57dfec85baad4c3840fec6829d2b957e5b49a34afa95c74cc0","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-c6-8bc75783.json","sourceId":"wf:C6","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-04-1a2bee69.json","targetId":"uc:UC-RISK-04","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:d870df4290a29a27fd912079a6e157aae03c0fff0f12eed186ad91d09a065fee","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-c6-8bc75783.json","sourceId":"wf:C6","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-10-6d44f690.json","targetId":"uc:UC-RISK-10","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:ed16bc97e01423c26331d1ecb77eca054fb85dcbffcb94a45240210d15311c11","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-c6-8bc75783.json","sourceId":"wf:C6","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-06-e9599494.json","targetId":"uc:UC-RISK-06","type":"oversees"}],"schemaVersion":1}