Overview

LowerPlane’s risk management module provides a structured approach to identifying, assessing, treating, and monitoring information security risks. The system supports the full risk management lifecycle required by 50+ compliance frameworks including ISO 27001, SOC 2, HIPAA, GDPR, and PCI-DSS, with tools for risk scoring, treatment tracking, and historical trend analysis.

Risk Registers

Organize and manage risks in dedicated registers with full CRUD operations, owner assignment, and control linking.

Risk Library

Pre-built catalog of common information security risks with industry mappings and framework references.

Risk Overview Dashboard

Real-time dashboard with risk distribution, heat maps, category breakdowns, and top risks by score.

Risk Snapshots

Point-in-time captures of your risk posture for trend analysis and compliance reporting.

Risk Scoring Model

LowerPlane uses a standard Likelihood x Impact matrix to calculate risk scores. Both inherent risk (before controls) and residual risk (after controls) are tracked for every risk.

Scoring Dimensions

DimensionScaleDescription
Likelihood1-5Probability of the risk materializing
Impact1-5Severity of consequences if the risk occurs

Likelihood Scale

ScoreLabelDescription
1RareHighly unlikely to occur
2UnlikelyNot expected but possible
3PossibleReasonable chance of occurring
4LikelyExpected to occur in most circumstances
5Almost CertainWill almost certainly occur

Impact Scale

ScoreLabelDescription
1NegligibleMinimal impact on operations
2MinorLimited impact, easily recoverable
3ModerateNoticeable impact requiring response
4MajorSignificant impact on operations or reputation
5CatastrophicSevere impact, potential business continuity threat

Risk Score Calculation

Risk Score = Likelihood x Impact
The resulting score (1-25) maps to a risk level:
Score RangeRisk LevelColor
1 - 4LowGreen
5 - 9MediumYellow
10 - 16HighOrange
17 - 25CriticalRed

Inherent vs. Residual Risk

Every risk in LowerPlane tracks two sets of scores:
  • Inherent Risk — the risk level before any controls or treatments are applied. This represents the raw exposure.
  • Residual Risk — the risk level after accounting for implemented controls and treatments. This represents the current, managed risk.
The difference between inherent and residual scores demonstrates the effectiveness of your control environment to auditors and stakeholders.
A large gap between inherent and residual risk indicates effective controls. If the gap is small, your controls may need strengthening or the risk treatment strategy may need revision.

Risk Treatments

Each risk must have a documented treatment strategy:
TreatmentDescriptionWhen to Use
MitigateImplement controls to reduce likelihood or impactMost common — apply security controls to reduce the risk
AcceptAcknowledge the risk and take no further actionRisk is within tolerance or cost of mitigation exceeds potential loss
TransferShift the risk to a third partyInsurance policies, outsourcing to specialized providers
AvoidEliminate the risk source entirelyStop the activity that creates the risk
Every risk should have a documented treatment, even if the treatment is “Accept.” Auditors expect to see a deliberate decision for each identified risk, not gaps where no treatment has been selected.

Risk Categories

Risks are organized into categories that align with common information security domains:
CategoryExamples
AI & Machine LearningModel bias, adversarial attacks, training data leakage
Data PrivacyUnauthorized data access, consent violations, data breach
Data ProtectionEncryption failures, backup gaps, data loss
Endpoint SecurityMalware infection, unpatched endpoints, stolen devices
Governance & ControlsPolicy gaps, audit failures, compliance drift
Identity & AccessCredential compromise, excessive privileges, orphaned accounts
Incident ResponseSlow detection, inadequate response procedures
InfrastructureServer outages, configuration drift, capacity issues
Network & PerimeterFirewall misconfiguration, DDoS, unauthorized access
Payment SecurityCard data exposure, PCI non-compliance
SDLC & DevOpsInsecure code, supply chain attacks, deployment risks
Source CodeCode leakage, IP theft, unauthorized repositories
Vendor ManagementThird-party breach, vendor non-compliance
WorkforceInsider threats, social engineering, insufficient training

Risk Statuses

StatusDescription
DraftRisk identified but not yet fully assessed
Needs ReviewRisk requires review by a risk owner or committee
Awaiting SubmissionRisk is being prepared for formal submission
Pending ApprovalRisk has been submitted and awaits management approval
Requested ChangesReviewer has requested modifications
ApprovedRisk has been formally accepted with its treatment plan

Risk Overview Dashboard

The overview dashboard provides a real-time summary of your risk posture:
  • Risk Heat Map — visual matrix showing risk distribution by likelihood and impact
  • Risk Distribution — pie chart of risks by level (critical, high, medium, low)
  • Category Breakdown — bar chart showing risk counts by category
  • Top Risks — table of highest-scored risks requiring attention
  • Treatment Summary — distribution of risks by treatment type
  • Trend Indicators — showing whether risk posture is improving, stable, or worsening

CIA Triad Classification

Risks can optionally be classified by their CIA triad category:
  • Confidentiality — risks related to unauthorized information disclosure
  • Integrity — risks related to unauthorized modification of data or systems
  • Availability — risks related to disruption of services or data access
This classification supports more granular risk analysis and helps prioritize risks based on your organization’s most critical information security objectives.

Integration with Other Modules

Risk management connects to multiple areas of the platform:
  • Controls — risks can be linked to specific controls, showing which controls mitigate which risks
  • Vendors — risks can be linked to vendors, enabling vendor-specific risk tracking
  • Compliance — risk registers and treatment plans serve as evidence for framework controls
  • Snapshots — point-in-time captures support trend analysis and compliance reporting

Next Steps

Risk Register

Create and manage your risk registers.

Risk Library

Browse pre-built risks to populate your register.

Risk Snapshots

Capture and compare risk posture over time.