Aktuelle Version vom 3. April 2026, 10:36 Uhr

Evaluation of risks and opportunities

In this overview, all risks and opportunities from the different management systems are displayed. It is also possible to display only the risks and opportunities of the current management system. Furthermore, risks and opportunities can be set to private, so that they are only displayed in the management system in which they were created.

If you click on a risk or opportunity, you can edit or view it. Then it is possible to view which gaps, threats, measures, or controls are assigned to this risk or opportunity.

Caution:

A risk/opportunity that is not "private" can be assessed separately for each management system that uses different classifications of damage and benefit. That is, assessments apply only to management systems that use the same classifications.

Risk or opportunity

A risk can be a collection of negative gaps that form a concrete danger for the linked entities. An opportunity can be a collection of positive gaps that form a concrete potential for the linked entities.

Gaps occur in the course of a review. This is the case, for example, when review questions of review objects are answered "negatively" or below the target score. Subsequently, the gaps can be assigned to risks. Positive gaps are answers that are "positive", or corresponding to or above the target score.

The review objects containing the review questions can also be associated with entities (resources, data categories, processes, and/or organizational units). This association creates a specific risk or a specific opportunity for the affected entities, which is visible in the structural analysis.

Risks and opportunities can also be recorded freely.

Freely recorded risks/opportunities normally have no linked gaps, but such gaps can be assigned to them. Freely entered risks can, for example, be a list of risks that was already maintained before HITGuard was implemented, e.g. with Excel. Such lists can be imported using the data importer. The same goes for opportunities.

Risks and opportunities can then be evaluated by selecting a probability of occurrence and an extent of damage or a benefit. This results in the risk score according to which the risk or opportunity is displayed in the risk management dashboard, for example. This evaluation is done according to the classification of extend of damage and benefit. This means: if a risk/opportunity was evaluated in one management system with classification "Standard", it can be evaluated differently in another management system with classification "Privacy" (as long as it is not marked as "Private").

The assessment/review of risks and opportunities can be delegated to the registered advisor (see workflow button). They will then find the risks and opportunities under their tasks to assess/review.

Within the risk itself:

the key data are displayed.
all gaps assigned to the risk or opportunity are displayed.
the measures/controls assigned to the gaps are listed.
the measures/controls that are manually assigned to the risk or opportunityare listed.

Furthermore, every change in the assessment is logged. This documentation can be found in the menu item "Temporal development".

Important: These should be post-documented for risks created before HITGuard Release October 2020. More on this can be found under Temporal development.

Creating and editing risks or opportunities

Page for creating/editing risks and opportunities

Code:

In the abbreviation, enter the abbreviated title of the risk/opportunity.

Status:

Active: The risk/opportunity still exists.
Closed: The risk/opportunity has been resolved.
Accepted: You are aware of the risk/opportunity, but will not fix it at this time for various reasons.
Changes here are logged (Temporal development).

Private:

If you set the risk/opportunity to private, it will only be displayed in the current management system. Otherwise, it is visible in every management system and can be evaluated for every classification of impact and benefit.
Measures, controls, threats, and gaps, however, are only visible in the respective management systems in which they were created, regardless of whether the risk or opportunity is marked as private.

Book button:

Book-Button
Here you can access templates for risks and opportunities stored in knowledge bases. The button is only available when you create a risk for the first time. When cyou click it, first choose the knowledge base you want to access. After that, you can search through the available risk templates. There are also “categories” that classify the risks by topic. Note that importing a risk does not create any risk categories in the risk policy.

Name and description:

In the name, write what the risk/opportunity should be named.
In the description, describe/explain the risk/opportunity.

Remarks:

Here, it can be explained how it came to the assessment of the risk/opportunity.

Strategy:

Coping strategies: these options describe how the risk will be dealt with.
- Undefined (it has not yet been determined how to deal with it)
- Avoidance (Waiver of the activity; in fact, the risk should then also be closed)
- Reduction (Probability of occurrence is reduced by measures)
- Transfer (Outsourcing of the hazard; e.g. by rolling over the hazard)
- Acceptance
Treatment strategies: these options describe how the potential will be dealt with.
- Exploit
- Ignore
- Share
- Enhance

Probability of occurrence:

Here, you can enter how likely it is that the risk will affect the company or an opportunity presents itself to the company.
For more information, see Probability of occurrence
Changes here are logged (Temporal development).

Extent of damage/benefit:

Here, you can enter how big is the potential damage or benefit that can be caused by the risk/opportunity.
Only damage extents and benefits of the classification of the current management system are available.
Changes here are logged (Temporal development).

Monetary impact:

Here, you can record how big the possible monetary impact of the risk or opportunity is.

Categories of risks and opportunities:

Here, you can record which categories you are assigning the risk/opportunity to.
For more information, see Categories of risks and opportunities.

Responsibility and advisors:

The person in charge is the primary contact for the risk/opportunity.
The advisors are responsible for risk/opportunity handling. If a review of the risk/opportunity is requested, the advisors are responsible for the review.

Assigned protection goals and weightings:

Here you can specify which protection goals your risk (or opportunity) affects. Through which protection goal will the damages that the risk represents likely manifest? For example, if the risk is “server outage”, it is reasonable to rate availability high, integrity low, and confidentiality barely at all. You can also display the protection goals in the overview of risks and opportunities and sort by them.

Norm mapping:

If the risk/opportunity deals with one or more norm chapters they should be entered here.

Affected structural elements:

All structural elements are listed here that are related to the risk/opportunity via gaps.
By opening the drop-down menu, structural elements can be linked to the risk/opportunity. Furthermore, it can be seen here from which review object the automatically set links come.
Example:

The risk "Temperature problems in server rooms", for example, is linked to the structural element "Server room" via a gap from checking the server rooms.

External ID:

Through this ID, the risk/opportunity can be updated via an import. For this to work, the “Record ID” in the import file must match the “ID in third‑party system” of the risk/opportunity being updated. This field should only be adjusted manually if the risk/opportunity was already created manually and is intended to be updated through imports in the future.

Attachments:

Here you can add documents or links as attachments to the risk.

Assigned gaps

This tab lists all gaps that are assigned to the risk/opportunity. This is normally the result of the gap handling of a review. However, you can also assign existing gaps to the risk/opportunity here.

Target score weighting:

If enabled, the sorting of protection targets is based on the target score weighting. The greater the deviation from the target score and the greater the weighting of the protection target, the greater the target score weighting. More about the target score weighting can be found here.

Caution: Only gaps of the current management system are displayed. Just because the risk/opportunity in this management system has no gaps does not mean that none exist.

Display of gaps:

Black: Gaps assigned to this risk/opportunity that have not been corrected.
Green: Gaps assigned to this risk/opportunity that have been remediated or indicated as having at least the target score.
Gray: These are historical gaps. These were identified in previous reviews and assigned to the risk. In the meantime, the review objects of these reviews have already been subject to a reassessment.
Moved to Risk xx: The gap was originally assigned to the currently presented risk/opportunity. In a further step, the assignment changed to another risk/opportunity: Risk/opportunity xx.

Assign gaps Click on "Assign gaps" to open a screen for assigning gaps.

Zugewiesene Bedrohungen

In diesem Reiter werden alle Bedrohungen gelistet, die dem Risiko/der Chance zugewiesen sind. Die Bedrohungen kommen entweder aus der Verknüpfung mit einer Abweichung, werden von den verfügbaren ausgewählt (Link Button) oder werden hier speziell für das Risiko/die Chance erstellt ("Plus" Button).

Measures & controls

This tab lists all measures and controls that have been assigned to the risk/opportunity and therefore contribute to the treatment. Depending on their state they are displayed either in the top or the bottom table, more on this below. The measures and controls either come from the assignment of a gap, are selected from the available list (link button) or are created here specifically for the risk/opportunity (plus button). If a measure is created here, the responsible is preset with the responsible of the risk, but can be changed.

Find out more about creating measures here and more about creating controls here.

If measures and controls come from a gap, the assignment to the risk/opportunity can only be removed by removing the assignment to the respective gap. Assignments of measures or controls selected from the available list or created here can be removed with the button to the right of the measure or control.

Caution: Only measures and controls of the current management system are displayed. The risk/opportunity not having any measures or controls in this management system does not mean it doesn't have assigned measures or controls in a different management system.

Gross risk/opportunity

Gross (inherent) is the evaluation that evaluates the initial risk. It depicts the original situation before any measures and controls for its treatment were put into effect. The gross risk/opportunity is marked with a badge in the temporal development page when it is first recorded. The information in the tab Measures and controls reflects this and cannot be changed manually.

The button to the right opens a risk matrix that vizualizes the risk/opportunity.

Measures and controls for the treatment of the gross risk/opportunity

These measures and controls were introduced to treat the original gross risk/opportunity. Through them the risk/opportunity is turned from the gross (inherent) risk/opportunity into the current risk/opportunity. They are completed and/or canceled measures, as well as active control definitions with successful executions.

If a new measure or control is implemented and thus inserted into this table, it is recommended to revaluate the risk/opportunity. The risk/opportunity and the triggering measure or control are then marked with "Revaluation recommended". The revaluation shows whether the current risk/opportunity has changed with the impact of the implementation. In the case of measures, this is only triggered if the "Completed" date was set and doesn't fall on the same day of the last relevant revaluation (a relevant revaluation in this context is a change entry in the temporal development log where either extent of damage or benefit or probability of occurrence were changed).

If measures were implemented or controls executed that did have an impact on the risk/opportunity, but not enough of one to actually change the probability of occurrence or the extent of damage or benefit, the revaluation can also show that no sufficiently significant change was made. To do this, create a new entry in the temporal development with the "plus" button and set the same values that applied until then. The current risk/opportunity is therefore not changed. The justification can be used to document why a measure and/or control did not have more of an impact on the risk/opportunity.

Ability to control:

This is the evaluation of the quality of the set of treatment measures and controls that has already been implemented.
The abilities to control available for selection can be configured in the Risk policy.

Current risk/opportunity:

Current is the evaluation of the risk/opportunity after all already implemented measures and executed controls for its treatment have been taken, and before the still planned measures and controls have been implemented.
Again, a matrix to show the position of the current risk/opportunity is available through the button to the right.

Excerpt: Measures and controls for treatment of the gross risk/opportunity

Measures and controls for treatment of the current risk/opportunity

These measures and controls are planned for the treatment of the current risk/opportunity and are meant to reduce it to the planned net (residual) risk or enhance it to the planned net opportunity. They are open, planned and/or suspended measures (not implemented), as well as suspended, deactivated and/or active control definitions without executions.

Net risk/opportunity:

Net (residual) is the evaluation in the following scenario: 1) all implemented and planned, yet-to-be-implemented measures have been taken AND 2) all implemented and yet-to-be-implemented controls have been put into effect. As this is a prognosis for the future, three variations are to be recorded: best case, most likely case, worst case.
The evaluation of the net risk/opportunity can be done either with the dropdown boxes or directly in the displayed matrices. A click into a square in a matrix sets the corresponding values for probability of occurrence and extent of damage or benefit.

Excerpt: Measures and controls for treatment of the current risk/opportunity

Temporal development

The temporal development page is a change log that records every change to the risk (or opportunity). This includes changes made by experts as well as changes in the workflow (see below). If an expert user changes the probability of occurrence, the severity/senefit, or the status, the user must enter a justification for their changes in the change log. Only then will the change be saved. If a workflow user makes a change to the risk, they must also provide a justification, for the change log.

A log entry then appears in the temporal development page of the risk (or opportunity). The oldest entry in which the probability of occurrence and the severity/benefit are defined is marked here as “Gross Risk” or “Gross Opportunity” and is listed under the “Measures and Controls” tab for the respective risk or opportunity.

You can also manually create an entry for the temporal development. To do so, simply click the “Plus” button in the overview. You can also edit existing entries in this overview by double-clicking on the respective entry.

Note: Since risks can be shared with other management systems by unchecking the “Private” box, the management systems also share the temporal development page. If the risk is modified in one management system, the entry in the change log will also be visible in the other management systems. Changes created under a different classification of damage extent and benefits are also visible. However, entries can only be edited in the management system in which they were created.

Risk Assessment Workflow

At the very bottom of the edit risk page you will find three buttons. Here you can Save, Close, or send the risk into the workflow via “Request update”. With every step in the workflow, an entry for the temporal development page (see above) is created. These entries can be edited by expert users. The workflow is explained in detail below:

Starting the workflow

Save: In case you adjusted Probability of occurrence, Severity/Benefit, or Strategy, HITGuard will require you to enter a justification for the change log, which is then stored under in the temporal development page.
Request update: This button starts the workflow. HITGuard sends the risk to the users listed in the Advisor field and gives them the option to update it. In a pop up you can write a message to the Advisors to provide context. Additionally, HITGuard sends an automatic e mail to the Advisors.

Note: Advisors can also start the workflow on their own. Under My Tasks > Risks and Opportunities, they can report a risk (or opportunity) or update an existing risk (or opportunity) using two corresponding buttons.

Workflow from the Advisor’s perspective

When Advisors open the risk assigned to them, they are first greeted by the message that the expert entered when requesting the update. The expert is labeled as “Examiner”:

Advisors can view the risk and edit several data fields:

Name, Description, & Remarks
Strategy, probability of occurrence, & Severity/Benefit
Monetary impact, Identified on date
They may also link or unlink measures and controls for which they themselves are defined as the responsible user.

Finally, Advisors also have several buttons available:

Messages & History: Opens the modal containing the expert’s message, which first appeared when the risk was opened.
Show changes: Opens an overview of the changes the Advisor has made so far.
Submit update: Ends the Advisor’s editing mode and sends the update back to the expert. The Advisor must provide a justification for the changes, which is then stored in the temporal development page. Additionally, a message to the reviewer can be added. This modal is shown in the screenshot below:

history of messages between expert and Advisor

With each workflow step, users leave a message. The expert is marked as “Examiner”. An example of a message exchange between the requesting expert and the responding Advisor is shown in the screenshot on the right.

In this example, the expert has requested another revision of the risk after the Advisor returned it the first time.
The users listed as “Responsible” in the risk are not notified by e mail, but they can also edit data. They can do everything that Advisors can do. Additionally, they can edit the Advisor field, meaning they can replace or add Advisors.

The Workflow from the Expert User’s Perspective

As long as the risk is with the Advisor, it is set to read-only for all other users. However, they can view the changes made so far:

Update pending: Here experts can view the changes made so far by the Advisor and decide to already accept or discard them.
Notes: Here experts can see the message history, including their messages to the Advisor.

If the Advisor has already returned the risk, experts can review the changes before they are applied:

Review update: Opens an overview of the changes made by the practitioner.

You can see this overview in the screenshot below:

Decline update: Discards the Advisor’s updates. The risk remains as it was before the workflow started.
Request changes: Sends the update back to the Advisor. When clicking this, you may add another message for the Advisor.
Accept update: Applies all changes made by the Advisor and updates the risk.
Cancel: Closes the modal without completing the workflow.

Regardless of whether you ultimately accept or reject the update, HITGuard will require an entry for the temporal development page. In any case, the Advisor’s justification is also recorded there. The entries under temporal development are editable for expert users.

@@ Zeile 1: / Zeile 1: @@
-In this overview, all hazard situations from the different management systems are displayed. It is also possible to display only the hazards of the current management system. Furthermore, hazard layers can be set to private, so that they are only displayed in the management system in which they were created.
+<span id="Bewertung_von_Risiken_und_Chancen"></span>
+=Evaluation of risks and opportunities=
-If you click on a hazard location, you can edit or view it. Then it is possible to view which deviations, measures or controls are assigned to this hazard layer.
+In this overview, all risks and opportunities from the different management systems are displayed. It is also possible to display only the risks and opportunities of the current management system. Furthermore, risks and opportunities can be set to private, so that they are only displayed in the management system in which they were created.
+If you click on a risk or opportunity, you can edit or view it. Then it is possible to view which gaps, threats, measures, or controls are assigned to this risk or opportunity.
 <b>Caution:</b>
-* A hazard situation that is not "private" can be assessed separately for each management system that uses different damage extent classifications. That is, assessments apply only to management systems that use the same extent-of-damage classifications.
+* A risk/opportunity that is not "private" can be assessed separately for each management system that uses different classifications of damage and benefit. That is, assessments apply only to management systems that use the same classifications.
-[[Datei:Risiken.png|left|thumb|901px|Hazards<br>[[Risk Policy#riskmatrix|Risk Indicator]]]]
+[[Datei:Risiken.png|left|thumb|903px|Overview of Risks and Chances]]
 <br clear=all>
 __TOC__
-== Threat situation ==
+<span id="Risiko_oder_Chance"></span>
+== Risk or opportunity ==
+A risk can be a collection of negative gaps that form a concrete danger for the linked entities. An opportunity can be a collection of positive gaps that form a concrete potential for the linked entities.
-A hazard situation can be a collection from deviations that form a concrete danger for the linked entities.
+Gaps occur in the course of a review. This is the case, for example, when review questions of review objects are answered "negatively" or below the target score. Subsequently, the gaps can be assigned to risks. Positive gaps are answers that are "positive", or corresponding to or above the target score.
-Deviations occur in the course of a review. This is the case, for example, when test questions of test objects are answered "negatively" or below target maturity level. Subsequently, the deviations can be assigned to hazard layers.
+The review objects containing the review questions can also be associated with entities (resources, data categories, processes, and/or organizational units). This association creates a specific risk or a specific opportunity for the affected entities, which is visible in the structural analysis.
-Die Prüfobjekte, in denen sich die Prüffragen befinden, können mit Entitäten (Ressorucen, Datenkategorien, Prozessen und/oder Organisationseinheiten) verknüpft werden. Durch diese Zuweisung entsteht bei den betroffenen Entitäten eine konkrete Gefährdungslage, die in der Strukturanalyse ersichtlich ist.
+Risks and opportunities can also be recorded freely.
-Hazardous situations can also be recorded freely.
+Freely recorded risks/opportunities normally have no linked gaps, but such gaps can be assigned to them. Freely entered risks can, for example, be a list of risks that was already maintained before HITGuard was implemented, e.g. with Excel. Such lists can be imported using the [[Special:MyLanguage/Data import| data importer]]. The same goes for opportunities.
-Freely recorded hazard layers normally have no linked deviations, but such deviations can be assigned to them. Freely entered hazard layers can, for example, be a list of risks that was already maintained before HITGuard was used, e.g. with Excel. Such lists can be obtained using the [[Special:MyLanguage/Data import| Data importer]].
+Risks and opportunities can then be evaluated by selecting a probability of occurrence and an extent of damage or a benefit. This results in the risk score according to which the risk or opportunity is displayed in the risk management dashboard, for example. This evaluation is done according to the classification of extend of damage and benefit. This means: if a risk/opportunity was evaluated in one management system with classification "Standard", it can be evaluated differently in another management system with classification "Privacy" (as long as it is not marked as "Private").
-Hazard situations can then be evaluated by selecting a probability of occurrence and an extent of damage. This results in the risk score according to which the hazard situation is displayed in the risk management dashboard, for example. This evaluation is done according to the extent of damage classification. This means: If a hazard situation was evaluated in one management system with classification "Standard", it can be evaluated differently in another management system with classification "Privacy" (as long as it is not marked as "Private").
+The assessment/review of risks and opportunities can be delegated to the registered advisor (see workflow button). They will then find the risks and opportunities under their tasks to assess/review.
-In der Gefährdungslage selbst werden:
+Within the risk itself:
-* die Eckdaten dargestellt
+* the key data are displayed.
-* alle Abweichungen, die der Gefährdungslage zugewiesen sind, angezeigt.
+* all gaps assigned to the risk or opportunity are displayed.
-* die Maßnahmen/Kontrollen, die den Abweichungen zugewiesen sind, aufgelistet.
+* the measures/controls assigned to the gaps are listed.
-* die Maßnahmen/Kontrollen, die der Gefährdungslage manuell zugewiesen sind, aufgelistet.
+* the measures/controls that are manually assigned to the risk or opportunityare listed.
-Weiters wird jede Änderung der Gefährdungslage / Risikobewertung protokolliert. Diese Dokumentation ist im Menüpunkt "Zeitliche Entwicklung" zu finden.
+Furthermore, every change in the assessment is logged. This documentation can be found in the menu item "Temporal development".
-<b>Wichtig:</b> Diese sollten für Gefährdungslagen die vor HITGuard Release Oktober 2020 erstellt wurden, nachdokumentiert werden. Mehr dazu findet sich unter [[#time_dev| Zeitliche Entwicklung]].
+<b>Important:</b> These should be post-documented for risks created before HITGuard Release October 2020. More on this can be found under [[#time_dev| Temporal development]].
-[[Datei:Risikobewertung menuefuehrung.PNG|left|thumb|901px|Gefährdungslage Menüführung]]
+[[Datei:Risikobewertung menuefuehrung.PNG|left|thumb|902px|Risk menu navigation]]
 <br clear=all>
-== <span id="create_rsik"></span> Gefährdungslage erfassen / bearbeiten ==
+<span id="Risiko_oder_Chance_erfassen_&amp;_bearbeiten"></span>
+== <span id="create_rsik"></span> Creating and editing risks or opportunities==
-[[Datei:Maske Risiko bearbeiten.PNG|left|thumb|901px|Maske zum erfassen / bearbeiten von Gefährdungslagen]]
+[[Datei:Maske Risiko bearbeiten.PNG|left|thumb|901px|Page for creating/editing risks and opportunities]]
 <br clear=all>
-<u>Kürzel:</u>
+<u>Code:</u>
-*Beim Kürzel tragen Sie den abgekürzten Titel der Gefährdungslage ein.
+*In the abbreviation, enter the abbreviated title of the risk/opportunity.
 <u>Status:</u>
-*Aktiv: Die Gefährdungslage besteht noch.
+*Active: The risk/opportunity still exists.
-*Geschlossen: Die Gefährdungslage wurde behoben.
+*Closed: The risk/opportunity has been resolved.
-*Akzeptiert: Sie sind sich der Gefährdungslage bewusst, werden diese aber aus unterschiedlichen Gründen derzeit nicht beheben.
+*Accepted: You are aware of the risk/opportunity, but will not fix it at this time for various reasons.
-*Änderungen hier werden protokolliert ([[#time_dev|Zeitliche Entwicklung]])
+*Changes here are logged ([[#time_dev|Temporal development]]).
+<u>Private:</u>
+*If you set the risk/opportunity to private, it will only be displayed in the current management system. Otherwise, it is visible in every management system and can be evaluated for every classification of impact and benefit.
+*Measures, controls, threats, and gaps, however, are only visible in the respective management systems in which they were created, regardless of whether the risk or opportunity is marked as private.
+<u>Book button:</u>
+* [[Datei:6061BuchButton.png|right|thumb|100px|Book-Button]] Here you can access templates for risks and opportunities stored in [[Special:MyLanguage/Wissensdatenbanken|knowledge bases]]. The button is only available when you create a risk for the first time. When cyou click it, first choose the knowledge base you want to access. After that, you can search through the available risk templates. There are also “categories” that classify the risks by topic. Note that importing a risk does not create any [[Special:MyLanguage/Risikopolitik#Kategorien_von_Risiken/Chancen_und_Auswirkungen|risk categories]] in the risk policy.
+<u>Name and description:</u>
+*In the name, write what the risk/opportunity should be named.
+*In the description, describe/explain the risk/opportunity.
+<u>Remarks:</u>
+* Here, it can be explained how it came to the assessment of the risk/opportunity.
+<u>Strategy:</u>
+* Coping strategies: these options describe how the risk will be dealt with.
+** Undefined (it has not yet been determined how to deal with it)
+** Avoidance (Waiver of the activity; in fact, the risk should then also be closed)
+** Reduction (Probability of occurrence is reduced by measures)
+** Transfer (Outsourcing of the hazard; e.g. by rolling over the hazard)
+** Acceptance
+* Treatment strategies: these options describe how the potential will be dealt with.
+** Exploit
+** Ignore
+** Share
+** Enhance
+<u>Probability of occurrence:</u>
+*Here, you can enter how likely it is that the risk will affect the company or an opportunity presents itself to the company.<br>For more information, see [[Risk Policy#prob|Probability of occurrence]]
+*Changes here are logged ([[#time_dev|Temporal development]]).
+<u>Extent of damage/benefit:</u>
+* Here, you can enter how big is the potential damage or benefit that can be caused by the risk/opportunity.
+* Only damage extents and benefits of the classification of the current management system are available.
+* Changes here are logged ([[#time_dev|Temporal development]]).
+<u>Monetary impact:</u>
+* Here, you can record how big the possible monetary impact of the risk or opportunity is.
-<u>Privat:</u>
+<u>Categories of risks and opportunities:</u>
-*Stellen Sie die Gefährdungslage auf privat, so wird die Gefährdungslage nur noch im angelegten Managementsystem angezeigt. Andernfalls ist sie in jedem Managementsystem sichtbar und kann für jede Schadensausmaßklassifikation bewertet werden.
+* Here, you can record which categories you are assigning the risk/opportunity to.<br>For more information, see [[Risikopolitik#Risikokategorien|Categories of risks and opportunities]].
-*Maßnahmen, Kontrollen und Abweichungen sind allerdings nur in den jeweiligen Managementsystemen zu sehen, in denen diese erstellt wurden, unabhängig davon, ob die Gefährdungslage als privat gekennzeichnet wurde.
-<u>Bezeichnung und Beschreibung:</u>
+<u>Responsibility and advisors:</u>
-*Bei der Bezeichnung muss eingetragen werden wie die Gefährdungslage benannt werden soll.
+*The person in charge is the primary contact for the risk/opportunity.
-*Bei der Beschreibung sollten Sie die Gefährdungslage beschreiben/erklären.
+*The advisors are responsible for risk/opportunity handling. If a review of the risk/opportunity is requested, the advisors are responsible for the review.
-<u>Eintrittswahrscheinlichkeit:</u>
+<u>Assigned protection goals and weightings:</u>
-* Hier können Sie eintragen, wie wahrscheinlich es ist, dass die Gefährdungslage das Unternehmen trifft.<br>Mehr Information finden Sie unter [[Risikopolitik#prob|Eintrittswahrscheinlichkeit]]
+*Here you can specify which protection goals your risk (or opportunity) affects. Through which protection goal will the damages that the risk represents likely manifest? For example, if the risk is “server outage”, it is reasonable to rate availability high, integrity low, and confidentiality barely at all. You can also display the protection goals in the overview of risks and opportunities and sort by them.
-*Änderungen hier werden protokolliert ([[#time_dev|Zeitliche Entwicklung]])
-<u>Schadensausmaß:</u>
+<u>Norm mapping:</u>
-* Hier können Sie eintragen wie groß der potenzielle Schaden ist, der durch die Gefährdungslage entstehen kann.
+*If the risk/opportunity deals with one or more norm chapters they should be entered here.
-* Es stehen nur Schadensausmaße der Klassifikation des aktuellen Managementsystems zur Verfügung.
-* Änderungen hier werden protokolliert ([[#time_dev|Zeitliche Entwicklung]])
-<u>Verantwortlichkeit und Sachbearbeiter:</u>
+<u>Affected structural elements:</u>
-*Die verantwortliche Person ist der primäre Ansprechpartner für die Gefährdungslage
+* All structural elements are listed here that are related to the risk/opportunity via gaps.
-*Die Sachbearbeiter sind für die Risikobehandlung zuständig
+* By opening the drop-down menu, structural elements can be linked to the risk/opportunity. Furthermore, it can be seen here from which review object the automatically set links come.
+*Example:
+::: The risk "Temperature problems in server rooms", for example, is linked to the structural element "Server room" via a gap from checking the server rooms.
-<u>Zugewiesene Schutzziele und Gewichtungen:</u>
+<u>External ID:</u>
-*Hier können Sie festhalten welche Schutzziele wie stark betroffen sind, wenn die Gefährdungslage eintritt.<br>Beispiel:
+*Through this ID, the risk/opportunity can be updated via an import. For this to work, the “Record ID” in the import file must match the “ID in third‑party system” of the risk/opportunity being updated. This field should only be adjusted manually if the risk/opportunity was already created manually and is intended to be updated through imports in the future.
-::Gefährdungslage: Einbruch in den Serverraum
-::{| class="wikitable"
+<u>Attachments:</u>
-|-
+*Here you can add documents or links as attachments to the risk.
-! Schutzziel !! Gewichtung!! Erklärung
-|-
-| Vertraulichkeit
-|style="text-align:center;"| 4
-| Einbruch zum Diebstahl einer Festplatte
-|-
-| Verfügbarkeit
-|style="text-align:center;"| 4
-| Der Einbrecher könnte etwas zerstören
-|-
-| Integrität
-|style="text-align:center;"| 3
-| Er könnte auch am System etwas ändern
-|}
-<u>Norm-Mapping:</u>
+<span id="Zugewiesene_Abweichungen"></span>
-*Beschäftigt sich die Gefährdungslage mit einem oder mehreren Normkapiteln sollten diese hier eingetragen werden.
+=== <span id="Assigned deviations"></span>Assigned gaps ===
-<u>Betroffene Strukturelemente:</u>
+This tab lists all gaps that are assigned to the risk/opportunity. This is normally the result of the gap handling of a review. However, you can also assign existing gaps to the risk/opportunity here.
-* Hier werden alle Strukturelemente angeführt, die durch die Abweichungen mit der Gefährdungslage in Beziehung stehen.
-* Durch Öffnen des Dropdown-Menüs können Strukturelemente mit der Gefährdungslage verknüpft werden. Weiters wird hier ersichtlich, von welchem Prüfobjekt die automatisch gesetzten Verknüpfungen kommen.
-*Beispiel:
-::: Die Gefährdungslage "Temperaturprobleme in Serverräumen" wird z.B. über eine Abweichung beim Überprüfen der Serverräume mit dem Strukturelement "Serverraum" verknüpft.
-=== <span id="Zugewiesene Abweichungen"></span>Zugewiesene Abweichungen ===
+<u>Target score weighting:</u>
+*If enabled, the sorting of protection targets is based on the target score weighting. The greater the deviation from the target score and the greater the weighting of the protection target, the greater the target score weighting. More about the target score weighting can be found [[Special:MyLanguage/Schwachstellen#Zielreifegrad-Gewichtung|here]].
-In diesem Reiter werden alle Abweichungen gelistet, die der Gefährdungslage zugewiesen sind. Dies ist im Normalfall das Resultat der Abweichungsbehandlung einer Überprüfung. Sie können aber auch hier existierende Abweichungen zur Gefährdungslage zuweisen.
+<b>Caution:</b> Only gaps of the current management system are displayed. Just because the risk/opportunity in this management system has no gaps does not mean that none exist.
-<u>Zielreifegrad-Gewichtung:</u>
+[[Datei:Risiko zugewiesene Abweichungen.png|left|thumb|802px|Assigned gaps]]
-*Falls aktiviert, erfolgt die Sortierung von Schutzzielen anhand der Zielreifegrad-Gewichtung. Je größer die Abweichung vom Zielreifegrad und je größer die Gewichtung des Schutzzieles desto größer ist die Zielreifegrad-Gewichtung. Mehr zur Zielreifegrad-Gewichtung finden Sie [[Schwachstellen#Zielreifegrad-Gewichtung|hier]].
+<br clear=all>
+<b>Display of gaps:</b>
+* Black: Gaps assigned to this risk/opportunity that have not been corrected.
+* Green: Gaps assigned to this risk/opportunity that have been remediated or indicated as having at least the target score.
+* Gray: These are historical gaps. These were identified in previous reviews and assigned to the risk. In the meantime, the review objects of these reviews have already been subject to a reassessment.
+* Moved to Risk xx: The gap was originally assigned to the currently presented risk/opportunity. In a further step, the assignment changed to another risk/opportunity: Risk/opportunity xx.
+<b>Assign gaps</b>
+Click on "Assign gaps" to open a screen for assigning gaps.
+[[Datei:Risiko Abweichungen zuweisen.png|left|thumb|800px|Mask for assigning gaps]]
+<br clear=all>
-<b>Achtung:</b> Es werden nur Abweichungen des aktuellen Managementsystems angezeigt. Nur weil die Gefährdungslage in diesem Managementsystem keine Abweichungen hat, heißt das nicht, dass keine existieren.
+===Zugewiesene Bedrohungen===
+In diesem Reiter werden alle Bedrohungen gelistet, die dem Risiko/der Chance zugewiesen sind. Die Bedrohungen kommen entweder aus der Verknüpfung mit einer Abweichung, werden von den verfügbaren ausgewählt (Link Button) oder werden hier speziell für das Risiko/die Chance erstellt ("Plus" Button).
-[[Datei:Risiko zugewiesene Abweichungen.png|left|thumb|802px|Zugewiesene Abweichungen]]
+[[Datei:RM_ZugewieseneBedrohungen.png|left|thumb|800px|Assigned threats]]
 <br clear=all>
-<b>Darstellung der Abweichungen:</b>
-* Schwarz: Abweichungen, die dieser Gefährdungslage zugewiesen sind und nicht behoben wurden.
-* Grün: Abweichungen, die dieser Gefährdungslage zugewiesen sind und behoben oder mit mindestens dem Zielreifegrad angegeben wurden.
-* Grau: Hier handelt es sich um historische Abweichungen. Diese wurden in früheren Überprüfungen erkannt und der Gefährdungslage zugewiesen. Zwischenzeitlich wurden die Prüfgegenstände dieser Überprüfungen schon einer Neubewertung unterzogen.
-* Zu Gefährdungslage xx verschoben: Die Abweichung wurde ursprünglich der aktuell dargestellten Gefährdungslage zugewiesen. In einem weiteren Schritt änderte sich die Zuweisung zu einer anderen Gefährdungslage, der Gefährdungslage xx.
-==== Abweichungen zuweisen ====
+<span id="Maßnahmen_&amp;_Kontrollen"></span>
-Klicken Sie auf "Abweichungen zuweisen" öffnet sich eine Maske zum Zuordnen von Abweichungen.
+=== <span id="m_and_c"></span>Measures & controls ===
+This tab lists all measures and controls that have been assigned to the risk/opportunity and therefore contribute to the treatment. Depending on their state they are displayed either in the top or the bottom table, more on this below. The measures and controls either come from the assignment of a gap, are selected from the available list (link button) or are created here specifically for the risk/opportunity (plus button). If a measure is created here, the responsible is preset with the responsible of the risk, but can be changed.
+Find out more about creating measures [[Current Measures|here]] and more about creating controls [[Control definitions|here]].
+If measures and controls come from a gap, the assignment to the risk/opportunity can only be removed by removing the assignment to the respective gap. Assignments of measures or controls selected from the available list or created here can be removed with the button to the right of the measure or control.
-[[Datei:Risiko Abweichungen zuweisen.png|left|thumb|800px|Maske zum zuweisen von Abweichungen]]
+<b>Caution:</b> Only measures and controls of the current management system are displayed. The risk/opportunity not having any measures or controls in this management system does not mean it doesn't have assigned measures or controls in a different management system.
+[[Datei:GFL M und K Übersicht.png|center|700px|thumb|Tab Measures & controls]]
 <br clear=all>
-=== <span id="Zugewiesene Maßnahmen"></span>Maßnahmen / Kontrollen ===
+<span id="Bruttorisiko/-chance"></span>
+==== <span id="brutto"></span>Gross risk/opportunity====
+<b>Gross (inherent)</b> is the evaluation that evaluates the initial risk. It depicts the original situation before any measures and controls for its treatment were put into effect. The gross risk/opportunity is marked with a badge in the temporal development page when it is first recorded. The information in the tab Measures and controls reflects this and cannot be changed manually.
+The button to the right opens a risk matrix that vizualizes the risk/opportunity.
+[[Datei:Gefährdungslage Bruttorisiko.png|left|901px|thumb|Excerpt: Gross risk/opportunity]]
+<br clear=all>
-In dem jeweiligen Reiter werden alle Maßnahmen/Kontrollen gelistet, die der Gefährdungslage zugewiesen sind. Die Maßnahmen/Kontrollen kommen entweder direkt aus der Verknüpfung mit einer Abweichung, werden von den verfügbaren ausgewählt (blauer Button) oder werden hier speziell für die Gefährdungslage erstellt.
+<span id="Maßnahmen_und_Kontrollen_zur_Behandlung_des_Bruttorisikos/der_Bruttochance"></span>
+==== <span id="brutto_beh"></span> Measures and controls for the treatment of the gross risk/opportunity ====
-Kommen die Maßnahmen/Kontrollen von einer Abweichung, kann die Verknüpfung zur Gefährdungslage nicht aufgehoben werden.
+These measures and controls were introduced to treat the original gross risk/opportunity. Through them the risk/opportunity is turned from the gross (inherent) risk/opportunity into the current risk/opportunity. They are <strong>completed and/or canceled measures</strong>, as well as <strong>active control definitions with successful executions</strong>.
-Ist eine Abweichung grau, kann dies zwei Ursachen haben:
+If a new measure or control is implemented and thus inserted into this table, it is recommended to revaluate the risk/opportunity. The risk/opportunity and the triggering measure or control are then marked with "Revaluation recommended". The revaluation shows whether the current risk/opportunity has changed with the impact of the implementation. In the case of measures, this is only triggered if the "Completed" date was set and doesn't fall on the same day of the last relevant revaluation (a relevant revaluation in this context is a change entry in the temporal development log where either extent of damage or benefit or probability of occurrence were changed).
-# Das Prüfobjekt wurde einer Neubewertung unterzogen und die Abweichung hat sich als behoben herausgestellt.
+If measures were implemented or controls executed that did have an impact on the risk/opportunity, but not enough of one to actually change the probability of occurrence or the extent of damage or benefit, the revaluation can also show that no sufficiently significant change was made. To do this, create a new entry in the temporal development with the "plus" button and set the same values that applied until then. The current risk/opportunity is therefore not changed. The justification can be used to document why a measure and/or control did not have more of an impact on the risk/opportunity.
-# Die Abweichung wurde einer anderen Gefährdungslage zugewiesen.
-<b>Achtung:</b> Es werden nur Maßnahmen/Kontrollen des aktuellen Managementsystems angezeigt. Nur weil die Gefährdungslage in diesem Managementsystem keine Maßnahmen/Kontrollen hat, heißt das nicht, dass sie in anderen Managementsystemen keine Maßnahmen/Kontrollen hat.
+<u>Ability to control</u>:
+* This is the evaluation of the quality of the set of treatment measures and controls that has already been implemented.
+* The abilities to control available for selection can be configured in the [[Special:MyLanguage/Risikopolitik#atc | Risk policy]].
-[[Aktuelle Maßnahmen|Maßnahme erstellen]]<br>
+<u>Current risk/opportunity</u>:
-[[Kontrolldefinitionen|Kontrolle erstellen]]
+* Current is the evaluation of the risk/opportunity after all already implemented measures and executed controls for its treatment have been taken, and before the still planned measures and controls have been implemented.
+* Again, a matrix to show the position of the current risk/opportunity is available through the button to the right.
-[[Datei:Risiko Zugewiesene Maßnahme.png|left|thumb|801px|Zugewiesene Maßnahmen]]
+[[Datei:Gefährdungslage Behandlung Bruttorisiko.png|left|901px|thumb| Excerpt: Measures and controls for treatment of the gross risk/opportunity]]
 <br clear=all>
-[[Datei:Risiko Kontrollen zuweisen.png|left|thumb|800px|Maske zum zuweisen von Kontrollen]]
+<span id="Maßnahmen_und_Kontrollen_zur_Behandlung_des_aktuellen_Risikos/der_aktuellen_Chance"></span>
+==== <span id="aktuell_beh"></span>Measures and controls for treatment of the current risk/opportunity ====
+These measures and controls are planned for the treatment of the current risk/opportunity and are meant to reduce it to the planned net (residual) risk or enhance it to the planned net opportunity. They are <strong>open, planned and/or suspended measures</strong> (not implemented), as well as <strong>suspended, deactivated and/or active control definitions without executions</strong>.
+<u>Net risk/opportunity</u>:
+* Net (residual) is the evaluation in the following scenario: 1) all implemented and planned, yet-to-be-implemented measures have been taken AND 2) all implemented and yet-to-be-implemented controls have been put into effect. As this is a prognosis for the future, three variations are to be recorded: best case, most likely case, worst case.
+* The evaluation of the net risk/opportunity can be done either with the dropdown boxes or directly in the displayed matrices. A click into a square in a matrix sets the corresponding values for probability of occurrence and extent of damage or benefit.
+[[Datei:Gefährdungslage Behandlung Nettorisiko.png|left|901px|thumb| Excerpt: Measures and controls for treatment of the current risk/opportunity]]
 <br clear=all>
-== <span id="time_dev"></span> Zeitliche Entwicklung ==
+<span id="Zeitliche_Entwicklung"></span>
+== <span id="time_dev"></span> Temporal development ==
-Bei jeder Änderung der Eintrittswahrscheinlichkeit, des Schadensausmaßes und/oder Status, muss derjenige, der die Änderung durchführt, einen Eintrag zum Änderungsprotokoll mit Begründung und Datum für seine Änderung angeben. Nur wenn dies eingetragen wird, kann die Änderung durchgeführt werden. Ein Protokoll scheint anschließend in der zeitlichen Entwicklung der Gefährdungslage auf. Veränderungen an der Schadensausmaßbeurteilung scheinen nur in den Managementsystemen auf, die dieselbe Schadensausmaßklassifikation verwenden.
+The temporal development page is a change log that records every change to the risk (or opportunity). This includes changes made by experts as well as changes in the workflow (see below). If an expert user changes the probability of occurrence, the severity/senefit, or the status, the user must enter a justification for their changes in the change log. Only then will the change be saved. If a workflow user makes a change to the risk, they must also provide a <i>justification</i>, for the change log. <p>
+A log entry then appears in the temporal development page of the risk (or opportunity).
-<b>Wichtig:</b> Zeitliche Entwicklungen können auch manuell nachgetragen werden. Dafür in der Übersicht auf den "Plus"-Button klicken.
+The oldest entry in which the probability of occurrence and the severity/benefit are defined is marked here as “Gross Risk” or “Gross Opportunity” and is listed under the “Measures and Controls” tab for the respective risk or opportunity. <p> You can also manually create an entry for the temporal development. To do so, simply click the “Plus” button in the overview. You can also edit existing entries in this overview by double-clicking on the respective entry.
-[[Datei:Gefährdungslage zeitl entwicklung übersicht.PNG|left|thumb|802px|Zeitliche Entwicklung]]
+<!--delet-->
+[[Datei:Gefährdungslage zeitl entwicklung übersicht.PNG|left|thumb|900px|Temporal development]]
 <br clear=all>
-Einträge in dieser Übersicht können durch Doppelklick auf den jeweiligen Eintrag bearbeitet werden.
+<b>Note</b>: Since risks can be shared with other management systems by unchecking the “Private” box, the management systems also share the temporal development page. If the risk is modified in one management system, the entry in the change log will also be visible in the other management systems. Changes created under a different [[Special:MyLanguage/Risikopolitik#Schadensausmaße|classification of damage extent and benefits]] are also visible. However, entries can only be edited in the management system in which they were created.
-[[Datei:Gefährdungslage zeitl entwicklung Begründung anpassen.PNG|left|thumb|801px|Begründung anpassen]]
+[[Datei:Gefährdungslage zeitl entwicklung Begründung anpassen.PNG|left|thumb|900px|Modify justification]]
 <br clear=all>
-[[Datei:Gefährdungslage zeitl entwicklung neuer Eintrag.PNG|left|thumb|801px|Änderungseintrag manuell erstellen]]
+[[Datei:Gefährdungslage zeitl entwicklung neuer Eintrag.PNG|left|thumb|901px|Create change entry manually]]
 <br clear=all>
+<span id="Workflow_zur_Risikobewertung"></span>
+=Risk Assessment Workflow=
+At the very bottom of the edit risk page you will find three buttons. Here you can Save, Close, or send the risk into the workflow via “Request update”. With every step in the workflow, an entry for the temporal development page (see above) is created. These entries can be edited by expert users. The workflow is explained in detail below:
+<span id="Workflow_starten"></span>
+==Starting the workflow==
+[[Datei:5135AktualisierungAnfordernButton.png|left|thumb|700px|buttons for starting the workflow]]<br clear=all>
+*Save: In case you adjusted Probability of occurrence, Severity/Benefit, or Strategy, HITGuard will require you to enter a justification for the change log, which is then stored under [[Special:MyLanguage/Risikobewertung#Zeitliche_Entwicklung| in the temporal development]] page.
+*Request update: This button starts the workflow. HITGuard sends the risk to the users listed in the <b>Advisor</b> field and gives them the option to update it. In a pop up you can write a message to the Advisors to provide context. Additionally, HITGuard sends an automatic e mail to the Advisors.
+<b>Note:</b> Advisors can also start the workflow on their own. Under My Tasks > Risks and Opportunities, they can report a risk (or opportunity) or update an existing risk (or opportunity) using two corresponding buttons.
+<span id="Workflow_aus_Sicht_des_Sachbearbeiters"></span>
+==Workflow from the Advisor’s perspective==
+When Advisors open the risk assigned to them, they are first greeted by the message that the expert entered when requesting the update. The expert is labeled as “Examiner”:
+[[Datei:5135SachbearbeiterPopup.png|left|thumb|700px|message tot he Advisor]]<br clear=all>
+Advisors can view the risk and edit several data fields:
+*Name, Description, & Remarks
+* Strategy, probability of occurrence, & Severity/Benefit
+*Monetary impact, Identified on date
+*They may also link or unlink measures and controls for which they themselves are defined as the responsible user.
+Finally, Advisors also have several buttons available:
+[[Datei:5135ButtonsBeimSachbearbeiter.png|left|thumb|700px|buttons for the Advisor]]<br clear=all>
+*<b>Messages & History</b>: Opens the modal containing the expert’s message, which first appeared when the risk was opened.
+*<b>Show changes</b>: Opens an overview of the changes the Advisor has made so far.
+*<b>Submit update</b>: Ends the Advisor’s editing mode and sends the update back to the expert. The Advisor must provide a justification for the changes, which is then stored in the temporal development page. Additionally, a message to the reviewer can be added. This modal is shown in the screenshot below:
+[[Datei:5315SachearbeiterEinreichen.png|left|thumb|750px|justification modal for the advisor]] <br clear=all>
+[[Datei:5315Chatbox.png|right|thumb|650px|history of messages between expert and Advisor]] With each workflow step, users leave a message. The expert is marked as “Examiner”. An example of a message exchange between the requesting expert and the responding Advisor is shown in the screenshot on the right.
+<p>In this example, the expert has requested another revision of the risk after the Advisor returned it the first time.<br clear=all>
+The users listed as “Responsible” in the risk are not notified by e mail, but they can also edit data. They can do everything that Advisors can do. Additionally, they can edit the <i>Advisor</i> field, meaning they can replace or add Advisors.
+<span id="Workflow_aus_Sicht_des_Expert-Users"></span>
+==The Workflow from the Expert User’s Perspective==
+As long as the risk is with the Advisor, it is set to read-only for all other users. However, they can view the changes made so far:
+[[Datei:5135InAktualisierungButton.png|right|thumb|700px|Buttons im Workflow]]
+*<b>Update pending</b>: Here experts can view the changes made so far by the Advisor and decide to already accept or discard them.
+*<b>Notes</b>: Here experts can see the message history, including their messages to the Advisor.
+<br clear=all>
+If the Advisor has already returned the risk, experts can review the changes before they are applied:
+[[Datei:5135AktualisierungÜberprüfenButton.png|right|thumb|700px|buttons for ending the workflow]]
+*<b>Review update</b>: Opens an overview of the changes made by the practitioner.
+<br clear=all>
+You can see this overview in the screenshot below:
+[[Datei:5135AblehnenÄnderungAkzeptieren.png|left|thumb|700px|Buttons um den Workflow abzuschließen]]<br clear=all>
+*<b>Decline update</b>: Discards the Advisor’s updates. The risk remains as it was before the workflow started.
+*<b>Request changes</b>: Sends the update back to the Advisor. When clicking this, you may add another message for the Advisor.
+*<b>Accept update</b>: Applies all changes made by the Advisor and updates the risk.
+*<b>Cancel</b>: Closes the modal without completing the workflow.
+Regardless of whether you ultimately accept or reject the update, HITGuard will require an entry for the temporal development page. In any case, the Advisor’s justification is also recorded there. The entries under temporal development are editable for expert users.