Integrated Risk Management
One risk register, not five. Every risk scenario counts automatically toward the controls of every activated framework — DORA, NIS2, ISO 27001, EU AI Act and SOC 2 from the same assessment.
One assessment, five regimes.
The risk register holds scenarios with likelihood and impact under a generic 5×5 model. Each scenario can be linked to affected assets and controls; residual risk is calculated automatically from gross risk and the effectiveness of the linked controls.
Because the same register simultaneously serves DORA Art. 6, NIS2 Art. 21(a), ISO 27001 §6.1, EU AI Act Art. 9, and SOC 2 CC3.1–CC3.4/CC8.2, there's no more assessing risk separately per framework. Assess a risk once, and it counts across every activated use case.
A snapshot cryptographically signs and freezes the entire risk portfolio at a point in time — unchangeable and undeletable after the fact. That lets you show an auditor exactly what your risk posture looked like at, say, a quarterly review.
What the risk register delivers.
5×5 heatmap with residual-risk calculation
Scenarios by likelihood and impact, residual risk calculated automatically from gross risk and control effectiveness.
Cross-framework application
One assessment counts simultaneously toward DORA, NIS2, ISO 27001, EU AI Act and SOC 2 — visible per framework as "controls satisfied".
Sealed risk snapshots
A cryptographically signed, immutable state of the entire risk portfolio at a given date.
Asset and control linkage
Scenarios can be linked to affected assets and mitigating controls — residual risk is traceable, not estimated.
Approval workflow
Every scenario goes through an approval workflow before it counts toward the assessment.
One register, five "controls satisfied" rows.
Here's what the application looks like in the product.
DORA Art. 6
ICT risk management framework — the risk register as a central component.
NIS2 Art. 21(a)
Risk analysis and security for network and information systems, one of the ten minimum measures.
ISO 27001 §6.1
Risk assessment and treatment under ISO 27005 — threat/vulnerability pairs per asset.
EU AI Act Art. 9
Risk management system for high-risk AI systems.
SOC 2 CC3.1–CC3.4, CC8.2
Risk identification, analysis and change management as Trust Services Criteria.
How Integrated Risk Management works.
Log a scenario
Enter a risk with likelihood, impact, affected assets and mitigating controls.
Calculate residual risk
The engine calculates residual risk automatically from gross risk and control effectiveness — approval workflow included.
Seal a snapshot
The entire risk portfolio is signed and frozen at a given date — provable at any later point of review.
A core building block for these regimes.
ICT risk management framework under Art. 6 — register as its central component.
Regulation in detail →One risk assessment instead of five.
We'll show you how a single risk register can serve DORA, NIS2, ISO 27001, EU AI Act and SOC 2 at once.