risk-management-specialist

ISO 27005 and ISO 31000 risk assessment involves identifying threats and vulnerabilities, analyzing their impact and likelihood, evaluating risk levels against tolerance thresholds, and documenting findings. This Skill automates the full cycle—threat identification, risk scoring (inherent and residual), risk matrix mapping, and treatment planning—while maintaining alignment with ISO 27001 Annex A controls.

Yes. Data Reuse optimization leverages existing asset inventories, incident histories, control implementations, and business process documentation to accelerate new assessments. This Skill applies that data across multiple evaluations, reducing manual effort and ensuring consistency in risk identification and scoring.

Risk treatment planning defines mitigation strategies, assigns ownership, sets timelines, and establishes review checkpoints. This Skill automates treatment plan creation linked to relevant controls, manages multi-tenant data isolation, and supports escalation paths so teams can monitor progress and compliance status continuously.

Inherent risk is the baseline threat level before controls are applied; residual risk reflects the remaining threat after mitigation measures are in place. This Skill calculates both scores and maps them to risk matrices, helping teams understand the effectiveness of their control investments.

Yes. This Skill aligns risk assessments with ISO 27001 Annex A and cross-references ISO 27005, ISO 31000, and ISO 22301, enabling unified governance. Risk findings and treatment plans feed directly into control selection and compliance workflows.

Key Risk Indicators (KRIs) track risk trends over time through quantifiable metrics tied to threat and vulnerability sources. This Skill enables KRI definition, ongoing monitoring dashboards, and automated escalation when thresholds are breached, supporting continuous risk oversight.