​
Overview

LowerPlane’s risk management module provides a structured approach to identifying, assessing, treating, and monitoring information security risks. The system supports the full risk management lifecycle required by 50+ compliance frameworks including ISO 27001, SOC 2, HIPAA, GDPR, and PCI-DSS, with tools for risk scoring, treatment tracking, and historical trend analysis.

Risk Registers

Organize and manage risks in dedicated registers with full CRUD operations, owner assignment, and control linking.

Risk Library

Pre-built catalog of common information security risks with industry mappings and framework references.

Risk Overview Dashboard

Real-time dashboard with risk distribution, heat maps, category breakdowns, and top risks by score.

Risk Snapshots

Point-in-time captures of your risk posture for trend analysis and compliance reporting.

​
Risk Scoring Model

LowerPlane uses a standard Likelihood x Impact matrix to calculate risk scores. Both inherent risk (before controls) and residual risk (after controls) are tracked for every risk.

​
Scoring Dimensions

​
Likelihood Scale

​
Impact Scale

​
Risk Score Calculation

The resulting score (1-25) maps to a risk level:

​
Inherent vs. Residual Risk

Every risk in LowerPlane tracks two sets of scores:
  • Inherent Risk — the risk level before any controls or treatments are applied. This represents the raw exposure.
  • Residual Risk — the risk level after accounting for implemented controls and treatments. This represents the current, managed risk.
The difference between inherent and residual scores demonstrates the effectiveness of your control environment to auditors and stakeholders.
A large gap between inherent and residual risk indicates effective controls. If the gap is small, your controls may need strengthening or the risk treatment strategy may need revision.

​
Risk Treatments

Each risk must have a documented treatment strategy:
Every risk should have a documented treatment, even if the treatment is “Accept.” Auditors expect to see a deliberate decision for each identified risk, not gaps where no treatment has been selected.

​
Risk Categories

Risks are organized into categories that align with common information security domains:

​
Risk Statuses

​
Risk Overview Dashboard

The overview dashboard provides a real-time summary of your risk posture:
  • Risk Heat Map — visual matrix showing risk distribution by likelihood and impact
  • Risk Distribution — pie chart of risks by level (critical, high, medium, low)
  • Category Breakdown — bar chart showing risk counts by category
  • Top Risks — table of highest-scored risks requiring attention
  • Treatment Summary — distribution of risks by treatment type
  • Trend Indicators — showing whether risk posture is improving, stable, or worsening

​
CIA Triad Classification

Risks can optionally be classified by their CIA triad category:
  • Confidentiality — risks related to unauthorized information disclosure
  • Integrity — risks related to unauthorized modification of data or systems
  • Availability — risks related to disruption of services or data access
This classification supports more granular risk analysis and helps prioritize risks based on your organization’s most critical information security objectives.

​
Integration with Other Modules

Risk management connects to multiple areas of the platform:
  • Controls — risks can be linked to specific controls, showing which controls mitigate which risks
  • Vendors — risks can be linked to vendors, enabling vendor-specific risk tracking
  • Compliance — risk registers and treatment plans serve as evidence for framework controls
  • Snapshots — point-in-time captures support trend analysis and compliance reporting

​
Next Steps

Risk Register

Create and manage your risk registers.

Risk Library

Browse pre-built risks to populate your register.

Risk Snapshots

Capture and compare risk posture over time.