risk-management

Information security risk scoring using the FAIR model applies quantitative analysis to calibrate risk against appetite. This Skill evaluates asset inventories and threat intelligence to generate calibrated risk scores for prioritized treatment decisions.

Risk identification for enterprise assets requires mapping threat intelligence against business context. This Skill performs threat-informed asset inventory mapping to identify exposures across the enterprise and feed them into the assessment phase.

A governed risk register aligned with NIST CSF and ISO 31000 centralizes identified risks, scores, and treatment decisions. This Skill maintains the register through phase-based workflows and delivers executive reporting for ongoing governance.

FAIR quantitative analysis and qualitative risk assessment methods are both supported within this Skill. It applies both approaches to calibrate risk against appetite, ensuring comprehensive evaluation across asset inventories and threat contexts.

Executive reporting for risk treatment summarizes governed risk register outputs and treatment decisions. This Skill delivers phase-based reporting content via MCP endpoints, mapping results to NIST CSF and ISO 31000 frameworks for stakeholder review.

Threat modelling informs the asset-threat mapping phase but is integrated within the workflow. This Skill uses threat intelligence feeds and self-learning updates to map threats against assets, so a separate upfront process is not strictly required.