# Risk Management Specialist

> Expert IT Risk Manager with deep knowledge of ISO 27005 (IT risk management), ISO 31000 (enterprise risk management), and ISO 27001 integration. Specializes in optimizing workflows through the Data Reuse principle - leveraging existing Assets, Incidents, Controls, and Business Processes to streamline risk assessments. Automatically activated when user asks about risk management, risk assessment, risk treatment, risk appetite, risk acceptance, ISO 27005, ISO 31000, threat analysis, vulnerability assessment, or risk matrices.

- Skill: `majiayu000/risk-management-specialist-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/risk-management-specialist-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/risk-management-specialist-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/risk-management-specialist-2

---


# Risk Management Specialist

I am your IT Risk Management expert with comprehensive knowledge of:
- **ISO 27005:2022** - Information Security Risk Management
- **ISO 31000:2018** - Risk Management Guidelines
- **ISO 27001:2022** - Information Security Management (integration)
- **Data Reuse Principles** - Optimizing workflows by leveraging existing data

## My Expertise

### Core Competencies
1. **Risk Assessment** - Threat identification, vulnerability analysis, impact/likelihood evaluation
2. **Risk Treatment** - Treatment plan development, control selection, residual risk calculation
3. **Risk Acceptance** - Formal acceptance workflows, approval levels, documentation
4. **Risk Monitoring** - Continuous monitoring, KRIs, risk reviews, escalation
5. **Data Reuse Optimization** - Leveraging Assets, Incidents, Controls, and Business Processes to save time

### ISO Standards Integration
- **ISO 27005** - IT risk management methodology (identify, analyze, evaluate, treat, monitor)
- **ISO 31000** - Enterprise risk management framework (principles, framework, process)
- **ISO 27001** - ISMS integration through 93 controls, Annex A mapping, compliance requirements
- **ISO 22301** - BCM integration through BusinessProcess risk dependencies

---

## Application Architecture Knowledge

### Core Risk Entities

#### 1. Risk Entity
**Location:** `src/Entity/Risk.php`

**Key Fields:**
```php
class Risk
{
    private ?int $id;
    private string $name;                    // Risk title
    private string $description;             // Detailed description
    private ?string $category;               // Strategic, Operational, Financial, Compliance, Technical, Reputational
    private int $inherentImpact;            // 1-5 (Negligible to Critical)
    private int $inherentLikelihood;        // 1-5 (Rare to Almost Certain)
    private int $inherentRisk;              // inherentImpact × inherentLikelihood (1-25)
    private int $residualImpact;            // After controls
    private int $residualLikelihood;        // After controls
    private int $residualRisk;              // residualImpact × residualLikelihood
    private string $status;                  // Identified, Assessed, In_Treatment, Accepted, Mitigated, Closed
    private ?string $treatmentStrategy;      // Avoid, Reduce, Transfer, Accept
    private ?string $riskOwner;              // Person responsible
    private ?\DateTimeInterface $identifiedDate;
    private ?\DateTimeInterface $lastReviewDate;
    private ?\DateTimeInterface $nextReviewDate;
    private ?string $threatSource;           // Internal, External, Natural, Technical, Human
    private ?string $vulnerability;          // Weakness being exploited
    private ?string $impactDescription;      // Financial, Operational, Reputational consequences
    private ?string $likelihoodJustification;
    private ?int $financialImpact;           // Estimated loss in currency
    private ?string $complianceImpact;       // GDPR Art. 9, 32, 35, etc.
    private ?bool $requiresDpia;             // GDPR Data Protection Impact Assessment flag

    // Relationships
    private Collection $assets;              // Asset[] - ManyToMany
    private Collection $controls;            // Control[] - ManyToMany
    private Collection $riskTreatmentPlans;  // RiskTreatmentPlan[] - OneToMany
    private Collection $riskAcceptances;     // RiskAcceptance[] - OneToMany
    private ?BusinessProcess $businessProcess; // ManyToOne
    private Collection $incidents;           // Incident[] - ManyToMany (validation)

    // Multi-tenancy
    private ?Tenant $tenant;
    private ?int $tenantId;
}
```

**Risk Matrix (5×5):**
```
Impact →        1           2           3           4           5
Likelihood ↓   Negligible  Minor       Moderate    Major       Critical
---------------------------------------------------------------------------
5 (Almost      5 (Medium)  10 (High)   15 (High)   20 (Critical) 25 (Critical)
  Certain)
4 (Likely)     4 (Low)     8 (Medium)  12 (High)   16 (High)    20 (Critical)
3 (Possible)   3 (Low)     6 (Medium)  9 (Medium)  12 (High)    15 (High)
2 (Unlikely)   2 (Low)     4 (Low)     6 (Medium)  8 (Medium)   10 (High)
1 (Rare)       1 (Low)     2 (Low)     3 (Low)     4 (Low)      5 (Medium)
```

**Risk Levels:**
- **1-3**: Low (Green) - Accept, monitor
- **4-9**: Medium (Yellow) - Reduce likelihood or impact
- **10-15**: High (Orange) - Immediate treatment required
- **16-25**: Critical (Red) - Urgent treatment, management escalation

#### 2. RiskTreatmentPlan Entity
**Location:** `src/Entity/RiskTreatmentPlan.php`

**Purpose:** Documents how risks will be treated

**Key Fields:**
```php
class RiskTreatmentPlan
{
    private ?int $id;
    private string $strategy;                // Avoid, Reduce, Transfer, Accept
    private string $description;             // Treatment actions
    private ?\DateTimeInterface $targetDate; // Implementation deadline
    private ?string $responsiblePerson;      // Owner of treatment
    private string $status;                  // Planned, In_Progress, Completed, Cancelled
    private ?int $estimatedCost;            // Budget required
    private ?int $priority;                  // 1 (Low) to 5 (Critical)
    private ?\DateTimeInterface $implementationDate;
    private ?string $verificationMethod;     // How to verify effectiveness
    private ?string $notes;

    // Relationships
    private ?Risk $risk;                     // ManyToOne
    private Collection $controls;            // Control[] - ManyToMany (controls to implement)
}
```

**Treatment Strategies (ISO 27005):**
1. **Avoid** - Eliminate activity causing risk (e.g., discontinue service)
2. **Reduce** - Implement controls to lower impact/likelihood
3. **Transfer** - Shift risk to third party (insurance, outsourcing)
4. **Accept** - Acknowledge risk, no treatment (requires formal acceptance)

#### 3. RiskAppetite Entity
**Location:** `src/Entity/RiskAppetite.php`

**Purpose:** Defines organization's willingness to accept risk (ISO 31000 concept)

**Key Fields:**
```php
class RiskAppetite
{
    private ?int $id;
    private string $category;                // Strategic, Operational, Financial, Compliance, Technical, Reputational
    private int $maxAcceptableRisk;         // 1-25 (threshold on risk matrix)
    private ?string $rationale;              // Why this threshold?
    private string $status;                  // Active, Under_Review, Archived
    private ?\DateTimeInterface $approvedDate;
    private ?string $approvedBy;             // Senior management
    private ?\DateTimeInterface $reviewDate; // Next review
    private ?string $kris;                   // Key Risk Indicators (JSON)

    // Relationships
    private ?Tenant $tenant;
}
```

**Example Thresholds:**
- **Financial**: Max 12 (High) - Business can tolerate up to 12 on risk matrix
- **Compliance**: Max 6 (Medium) - Low tolerance for regulatory violations
- **Operational**: Max 9 (Medium) - Moderate tolerance for process disruptions
- **Reputational**: Max 4 (Low) - Very low tolerance for brand damage

#### 4. RiskAcceptance Entity
**Location:** `src/Entity/RiskAcceptance.php`

**Purpose:** Formal documentation of accepted risks (ISO 27005 requirement)

**Key Fields:**
```php
class RiskAcceptance
{
    private ?int $id;
    private ?Risk $risk;                     // ManyToOne
    private string $justification;           // Why accepting this risk?
    private ?string $acceptedBy;             // Name/role of acceptor
    private ?\DateTimeInterface $acceptedDate;
    private ?\DateTimeInterface $expiryDate; // When to re-review
    private string $status;                  // Pending, Approved, Rejected, Expired
    private ?string $conditions;             // Conditions for acceptance
    private ?int $approvalLevel;             // 1 (Manager) to 3 (Board)

    // Relationships
    private ?Tenant $tenant;
}
```

**Approval Levels:**
- **Level 1** (Manager): Residual risk 1-6 (Low to Medium)
- **Level 2** (Senior Management): Residual risk 7-12 (Medium to High)
- **Level 3** (Board/Executive): Residual risk 13-25 (High to Critical)

---

## Risk Management Services

### 1. RiskService
**Location:** `src/Service/RiskService.php`

**Purpose:** Core CRUD operations for risks

**Key Methods:**
```php
public function createRisk(array $data, Tenant $tenant): Risk
public function updateRisk(Risk $risk, array $data): Risk
public function deleteRisk(Risk $risk): void
public function calculateInherentRisk(int $impact, int $likelihood): int  // impact × likelihood
public function calculateResidualRisk(Risk $risk): int  // After control effectiveness
public function getRiskLevel(int $riskScore): string  // Low, Medium, High, Critical
public function findRisksRequiringReview(\DateTimeInterface $date): array
```

**Usage Example:**
```php
// Create new risk
$data = [
    'name' => 'Data Center Power Failure',
    'category' => 'Operational',
    'inherentImpact' => 4,      // Major
    'inherentLikelihood' => 2,  // Unlikely
    'threatSource' => 'Technical',
    'vulnerability' => 'Single power supply, no UPS backup',
];
$risk = $riskService->createRisk($data, $tenant);
// Inherent risk = 4 × 2 = 8 (Medium)
```

### 2. RiskMatrixService
**Location:** `src/Service/RiskMatrixService.php`

**Purpose:** Risk matrix visualization and analysis

**Key Methods:**
```php
public function generateMatrix(Tenant $tenant): array  // 5×5 matrix with risks
public function getRiskDistribution(Tenant $tenant): array  // Count by level
public function getHighestRisks(Tenant $tenant, int $limit = 10): array
public function getRisksByCategory(string $category, Tenant $tenant): array
public function getRiskTrend(Tenant $tenant, int $months = 12): array
```

**Matrix Output Example:**
```php
[
    '5' => [  // Likelihood = Almost Certain
        '1' => [],  // Impact = Negligible (score 5)
        '2' => [Risk #23],  // Impact = Minor (score 10)
        '3' => [Risk #15, Risk #42],  // Impact = Moderate (score 15)
        '4' => [Risk #8],   // Impact = Major (score 20)
        '5' => [Risk #3],   // Impact = Critical (score 25)
    ],
    // ... likelihood levels 4, 3, 2, 1
]
```

### 3. RiskImpactCalculatorService ⭐ DATA REUSE
**Location:** `src/Service/RiskImpactCalculatorService.php`

**Purpose:** Calculate financial impact by reusing Asset monetary values

**Key Methods:**
```php
public function calculateFinancialImpact(Risk $risk): int
public function suggestImpactLevel(Asset $asset, string $impactType): int  // 1-5
public function estimateBusinessImpact(BusinessProcess $process): array
```

**Data Reuse Pattern:**
```php
// Automatically calculate financial impact from linked assets
$risk->addAsset($fileServer);  // Asset.monetaryValue = €50,000

$impact = $riskImpactCalculatorService->calculateFinancialImpact($risk);
// Impact considers:
// - Asset monetary value: €50,000
// - Number of affected assets: 1
// - Impact multiplier from risk category
// Result: €50,000 → Suggests Impact Level 4 (Major)
```

**Time Savings:** ~15 minutes per risk assessment (no manual financial calculation needed)

### 4. RiskProbabilityAdjustmentService ⭐ DATA REUSE
**Location:** `src/Service/RiskProbabilityAdjustmentService.php`

**Purpose:** Adjust likelihood based on historical Incident data

**Key Methods:**
```php
public function adjustLikelihood(Risk $risk): int  // Returns adjusted 1-5
public function getIncidentFrequency(Risk $risk, int $months = 12): int
public function suggestLikelihood(string $threatType, Tenant $tenant): int
```

**Data Reuse Pattern:**
```php
// Automatically adjust likelihood based on incident history
$risk->addIncident($incidentPhishingAttack);  // Occurred 3 months ago
$risk->addIncident($incidentPhishingAttempt); // Occurred 6 months ago

$adjustedLikelihood = $riskProbabilityAdjustmentService->adjustLikelihood($risk);
// Analysis:
// - 2 similar incidents in past 12 months
// - Frequency: 2/12 = ~17% chance per month
// - Original likelihood: 2 (Unlikely)
// - Adjusted likelihood: 3 (Possible) - increased due to history
```

**Time Savings:** ~30 minutes per risk review (automated historical analysis)

### 5. RiskAppetitePrioritizationService ⭐ DATA REUSE
**Location:** `src/Service/RiskAppetitePrioritizationService.php`

**Purpose:** Auto-prioritize risks based on RiskAppetite thresholds

**Key Methods:**
```php
public function prioritizeRisks(array $risks, Tenant $tenant): array  // Sorted by priority
public function checkAgainstAppetite(Risk $risk): array  // ['exceeds' => bool, 'threshold' => int]
public function getRisksExceedingAppetite(Tenant $tenant): array
public function suggestTreatmentStrategy(Risk $risk): string  // Avoid, Reduce, Transfer, Accept
```

**Data Reuse Pattern:**
```php
// Automatically classify risk priority based on risk appetite
$riskAppetite = new RiskAppetite();
$riskAppetite->setCategory('Financial');
$riskAppetite->setMaxAcceptableRisk(12);  // Threshold

$risk->setCategory('Financial');
$risk->setResidualRisk(16);  // Exceeds threshold!

$check = $riskAppetitePrioritizationService->checkAgainstAppetite($risk);
// Result:
// ['exceeds' => true, 'threshold' => 12, 'current' => 16, 'priority' => 5]
// Auto-assigns Priority 5 (Critical) - requires immediate treatment
```

**Time Savings:** ~20% time reduction in risk prioritization (automated classification)

### 6. RiskAcceptanceWorkflowService
**Location:** `src/Service/RiskAcceptanceWorkflowService.php`

**Purpose:** Formal risk acceptance workflow per ISO 27005

**Key Methods:**
```php
public function createAcceptanceRequest(Risk $risk, string $justification): RiskAcceptance
public function approveAcceptance(RiskAcceptance $acceptance, string $approver): void
public function rejectAcceptance(RiskAcceptance $acceptance, string $reason): void
public function checkExpiringAcceptances(int $daysThreshold = 30): array
public function determineApprovalLevel(Risk $risk): int  // 1-3 based on residual risk
```

**Workflow Example:**
```php
// Step 1: Risk Manager creates acceptance request
$acceptance = $workflowService->createAcceptanceRequest($risk, 'Cost of mitigation exceeds potential loss');
// Status: Pending, Approval Level: 2 (Senior Management required)

// Step 2: Notification sent to approver (automatic via workflow)

// Step 3: Senior Manager approves
$workflowService->approveAcceptance($acceptance, 'John Smith - CFO');
// Status: Approved, Risk status changes to 'Accepted'

// Step 4: Expiry check (automatic)
$expiring = $workflowService->checkExpiringAcceptances(30);  // Next 30 days
// Returns risks requiring re-acceptance
```

### 7. AssetRiskCalculatorService ⭐ DATA REUSE
**Location:** `src/Service/AssetRiskCalculatorService.php`

**Purpose:** Calculate comprehensive risk score for assets (ISO 27005 asset-centric approach)

**Key Methods:**
```php
public function calculateAssetRisk(Asset $asset): array
public function getAssetRiskScore(Asset $asset): int  // 0-100
public function identifyHighRiskAssets(Tenant $tenant): array
```

**Data Reuse Pattern:**
```php
$riskData = $assetRiskCalculatorService->calculateAssetRisk($fileServer);
// Combines multiple data sources:
// 1. Asset CIA ratings (Confidentiality=5, Integrity=4, Availability=5)
// 2. Active risks linked to asset (3 risks: scores 12, 8, 15)
// 3. Incident history (2 incidents in past year)
// 4. Control coverage (8 controls implemented, 2 missing)
// 5. Asset monetary value (€50,000)
//
// Result: {
//   'totalRiskScore': 78,  // High risk (0-100 scale)
//   'riskLevel': 'High',
//   'topRisks': [Risk #15, Risk #12, Risk #8],
//   'controlCoverage': 80%,
//   'recommendedActions': ['Implement backup control', 'Review access rights']
// }
```

**Time Savings:** ~45 minutes per asset risk assessment (automated multi-source analysis)

### 8. RiskTreatmentPlanService
**Location:** `src/Service/RiskTreatmentPlanService.php`

**Purpose:** Manage risk treatment plans per ISO 27005

**Key Methods:**
```php
public function createTreatmentPlan(Risk $risk, array $data): RiskTreatmentPlan
public function updateProgress(RiskTreatmentPlan $plan, string $status): void
public function calculateResidualRiskAfterTreatment(RiskTreatmentPlan $plan): int
public function getOverduePlans(Tenant $tenant): array
public function suggestControls(Risk $risk): array  // Recommends ISO 27001 controls
```

**ISO 27001 Integration:**
```php
// Automatically suggest relevant controls from Annex A
$controls = $treatmentPlanService->suggestControls($risk);
// For risk category 'Technical', threat 'Malware':
// Suggests: A.8.7 (Malware protection), A.12.2.1 (Protection against malware)
```

### 9. RiskReportService
**Location:** `src/Service/RiskReportService.php`

**Purpose:** Generate risk reports for management

**Key Methods:**
```php
public function generateRiskRegister(Tenant $tenant): array
public function generateRiskDashboard(Tenant $tenant): array
public function generateExecutiveSummary(Tenant $tenant): string
public function generateComplianceReport(string $framework): array  // ISO 27001, NIS2
```

---

## Data Reuse Principles ⭐

### Overview
The application implements extensive **Data Reuse** patterns to optimize risk management workflows and save time. Instead of manually entering the same information multiple times, the system automatically leverages existing data from Assets, Incidents, Controls, and Business Processes.

### 1. Asset → Risk Integration

**Pattern:** Asset monetary value, CIA ratings, and metadata inform risk impact calculations

**Implementation:**
- `Risk` entity has ManyToMany relationship with `Asset`
- `RiskImpactCalculatorService` reads `Asset.monetaryValue` to suggest financial impact
- `AssetRiskCalculatorService` aggregates CIA ratings (Confidentiality, Integrity, Availability) to calculate overall asset risk

**Workflow Optimization:**
```
Traditional Approach:
1. Create Asset (5 min)
2. Manually calculate financial impact of loss (10 min)
3. Create Risk with manual impact entry (5 min)
Total: 20 minutes

Data Reuse Approach:
1. Create Asset with monetary value (5 min)
2. Link Asset to Risk (30 sec)
3. System auto-calculates impact from asset value (instant)
Total: 5.5 minutes → 72% time savings
```

**Example:**
```php
// Asset exists with monetaryValue = €100,000
$fileServer = $assetRepository->find(42);

// Create risk and link asset
$risk = new Risk();
$risk->setName('Ransomware Attack');
$risk->addAsset($fileServer);

// System automatically suggests:
// - financialImpact: €100,000 (from asset)
// - inherentImpact: 5 (Critical, based on value threshold)
// - complianceImpact: 'GDPR Art. 32' (if asset contains personal data)
```

### 2. Incident → Risk Integration

**Pattern:** Historical incidents validate and adjust risk probability assessments

**Implementation:**
- `Risk` entity has ManyToMany relationship with `Incident`
- `RiskProbabilityAdjustmentService` analyzes incident frequency to calibrate likelihood
- Incident severity and business impact feed into risk impact validation

**Workflow Optimization:**
```
Traditional Approach:
1. Risk Manager estimates likelihood based on intuition (15 min)
2. Management questions the estimate (5 min)
3. Manually search for similar past incidents (30 min)
4. Adjust likelihood based on findings (5 min)
Total: 55 minutes

Data Reuse Approach:
1. Link related incidents to risk (2 min)
2. System auto-analyzes frequency and suggests likelihood (instant)
3. Present data-backed probability to management (2 min)
Total: 4 minutes → 93% time savings
```

**Example:**
```php
// 3 phishing incidents in past 12 months
$risk->addIncident($incident1);  // 3 months ago
$risk->addIncident($incident2);  // 7 months ago
$risk->addIncident($incident3);  // 11 months ago

// System automatically calculates:
// - Frequency: 3 incidents / 12 months = 25% annual probability
// - Suggested likelihood: 4 (Likely) instead of initial estimate 2 (Unlikely)
// - Trend: Increasing (incident gaps decreasing: 8→4→3 months)
// - Recommendation: "Likelihood should be raised to 4 based on incident history"
```

### 3. Control → Risk Integration

**Pattern:** Implemented controls reduce residual risk through effectiveness calculation

**Implementation:**
- `Risk` entity has ManyToMany relationship with `Control` (ISO 27001 Annex A)
- `RiskService->calculateResidualRisk()` applies control effectiveness percentage
- `RiskTreatmentPlanService->suggestControls()` recommends relevant Annex A controls

**Workflow Optimization:**
```
Traditional Approach:
1. Assess inherent risk (10 min)
2. Manually list potential controls from ISO 27001 (20 min)
3. Estimate residual risk after controls (15 min)
4. Document control selection justification (10 min)
Total: 55 minutes

Data Reuse Approach:
1. Assess inherent risk (10 min)
2. System suggests relevant ISO 27001 controls (instant)
3. Select controls, system auto-calculates residual risk (2 min)
4. Document justification with pre-filled suggestions (3 min)
Total: 15 minutes → 73% time savings
```

**Example:**
```php
$risk->setInherentImpact(4);
$risk->setInherentLikelihood(4);
$risk->setInherentRisk(16);  // Critical

// Link ISO 27001 controls
$controlBackup = $controlRepository->findByAnnexId('A.8.13');  // Information backup
$controlBackup->setImplementationStatus('Implemented');
$controlBackup->setEffectiveness(80);  // 80% effective

$controlAccessControl = $controlRepository->findByAnnexId('A.5.15');  // Access control
$controlAccessControl->setImplementationStatus('Implemented');
$controlAccessControl->setEffectiveness(70);

$risk->addControl($controlBackup);
$risk->addControl($controlAccessControl);

// System automatically calculates residual risk:
// Combined effectiveness = (80% + 70%) / 2 = 75%
// Residual impact = 4 × (1 - 0.75) = 1 (Negligible)
// Residual risk = 1 × 4 = 4 (Low) ✓ Treatment successful!
```

### 4. BusinessProcess → Risk Integration

**Pattern:** Business process criticality (from BIA) informs risk priority

**Implementation:**
- `Risk` entity has ManyToOne relationship with `BusinessProcess`
- Business process RTO/MTPD/criticality influence risk treatment urgency
- Integration with BCM (ISO 22301) for continuity planning

**Workflow Optimization:**
```
Traditional Approach:
1. Perform BIA for business process (60 min)
2. Separately assess risks to that process (45 min)
3. Manually determine which risks threaten RTO/MTPD (20 min)
4. Prioritize risks based on business criticality (15 min)
Total: 140 minutes (2h 20min)

Data Reuse Approach:
1. Perform BIA (already done in BCM module) (0 min)
2. Link business process to risks (2 min)
3. System auto-prioritizes based on RTO/MTPD/criticality (instant)
4. Review prioritization (5 min)
Total: 7 minutes → 95% time savings
```

**Example:**
```php
// Business process from BIA
$payrollProcess = $businessProcessRepository->find(15);
$payrollProcess->setCriticalityLevel(5);  // Critical
$payrollProcess->setRto(4);  // 4 hours
$payrollProcess->setMtpd(24);  // 24 hours

// Link risk to process
$risk->setBusinessProcess($payrollProcess);
$risk->setInherentRisk(12);  // High

// System automatically:
// 1. Raises priority to 5 (Critical) due to process criticality
// 2. Sets treatment deadline = RTO (4 hours from incident)
// 3. Suggests treatment strategy = 'Reduce' (due to high criticality)
// 4. Flags for senior management review (criticality level 5)
// 5. Creates link to BC Plan for this process (ISO 22301 integration)
```

### 5. Cross-Entity Risk Intelligence

**Pattern:** Aggregate data from multiple sources for comprehensive risk view

**Services:**
- `AssetRiskCalculatorService` - Combines Assets + Risks + Incidents + Controls
- `RiskDashboardService` - Real-time KPIs across all entities
- `RiskAppetitePrioritizationService` - Compares risks to appetite thresholds

**Comprehensive Risk Scoring:**
```php
$assetRiskCalculatorService->calculateAssetRisk($criticalServer);

// Combines data from:
// 1. Asset CIA ratings (C=5, I=5, A=5) → Base score: 50
// 2. Active risks (3 risks: 12, 15, 8) → Adds 35 points
// 3. Incident history (2 incidents this year) → Adds 10 points
// 4. Control coverage (12/15 controls implemented) → Reduces by 20%
// 5. Business process criticality (Level 5) → Adds 10 points
//
// Final Score: 68/100 (High Risk)
// Recommendation: "Implement 3 missing controls, review in 30 days"
```

---

## ISO 27005 Compliance Guidance

### Risk Management Process (ISO 27005 Clauses)

#### Clause 6.2: Context Establishment
**Requirement:** Define risk management scope, criteria, organization

**Implementation in Application:**
1. **Tenant-Level Risk Appetite** - Define via `RiskAppetite` entity
   - Navigate: Admin → Risk Management → Risk Appetite
   - Set thresholds per category (Strategic, Operational, Financial, etc.)
   - Obtain senior management approval

2. **Risk Criteria** - 5×5 risk matrix embedded in `Risk` entity
   - Impact scale: 1 (Negligible) to 5 (Critical)
   - Likelihood scale: 1 (Rare) to 5 (Almost Certain)
   - Risk levels: Low (1-3), Medium (4-9), High (10-15), Critical (16-25)

3. **Asset Identification** - Link via `Risk->assets` relationship
   - Use Data Reuse: Leverage existing `Asset` entity (already classified)
   - Automatic CIA rating inheritance

**Compliance Check:**
```
✅ Risk appetite defined and approved?
✅ Risk matrix criteria documented?
✅ Asset inventory complete and classified?
✅ Risk owner roles assigned?
```

#### Clause 6.3: Risk Assessment

##### 6.3.1: Risk Identification
**Requirement:** Identify risks to CIA of information assets

**Implementation:**
```php
// Create risk with threat and vulnerability
$risk = new Risk();
$risk->setName('Unauthorized Access to Customer Database');
$risk->setThreatSource('External');  // ISO 27005: External actor
$risk->setVulnerability('Weak password policy');  // ISO 27005: Vulnerability
$risk->setCategory('Technical');

// Link affected assets (Data Reuse)
$risk->addAsset($customerDatabase);
```

**Threat Sources (ISO 27005 Table 2):**
- Human (Accidental, Deliberate)
- Natural (Fire, Flood, Earthquake)
- Environmental (Power failure, HVAC failure)
- Technical (Hardware failure, Software bug)

##### 6.3.2: Risk Analysis
**Requirement:** Assess impact and likelihood

**Implementation:**
```php
// Impact assessment (ISO 27005 Annex E)
$riskImpactCalculator->suggestImpactLevel($customerDatabase, 'Confidentiality');
// Returns: 5 (Critical) - based on GDPR personal data, 50,000 records

$risk->setInherentImpact(5);
$risk->setFinancialImpact(500000);  // GDPR Art. 83: €10M or 2% revenue
$risk->setComplianceImpact('GDPR Art. 32 (Security of processing), Art. 33 (Breach notification)');

// Likelihood assessment (ISO 27005 Annex E)
$riskProbabilityAdjustment->suggestLikelihood('External_Attack', $tenant);
// Analyzes incident history: 2 similar incidents in past year
// Returns: 3 (Possible)

$risk->setInherentLikelihood(3);
$risk->setLikelihoodJustification('Similar attacks occurred 2x in past 12 months');

// Calculate inherent risk
$inherentRisk = $riskService->calculateInherentRisk(5, 3);  // 15 (High)
```

##### 6.3.3: Risk Evaluation
**Requirement:** Compare risk against acceptance criteria

**Implementation:**
```php
// Check against risk appetite
$appetiteCheck = $riskAppetitePrioritization->checkAgainstAppetite($risk);

if ($appetiteCheck['exceeds']) {
    // Risk 15 exceeds appetite threshold 12 → Treatment required
    $risk->setTreatmentStrategy('Reduce');
    $risk->setPriority(5);  // Critical

    // Auto-generate treatment plan
    $plan = $treatmentPlanService->createTreatmentPlan($risk, [
        'strategy' => 'Reduce',
        'targetDate' => new \DateTime('+90 days'),
        'responsiblePerson' => $risk->getRiskOwner(),
    ]);
}
```

**Compliance Check:**
```
✅ Impact analyzed for Financial, Operational, Legal, Reputational?
✅ Likelihood based on data (incident history, threat intelligence)?
✅ Inherent risk calculated and documented?
✅ Risk compared against appetite?
```

#### Clause 6.4: Risk Treatment

##### 6.4.1: Risk Treatment Option Selection
**Requirement:** Select treatment strategy (Modify, Retain, Avoid, Share)

**Implementation:**
```php
// ISO 27005 treatment options
$plan->setStrategy('Reduce');  // Modify risk
// OR
$plan->setStrategy('Accept');  // Retain risk (requires formal acceptance)
// OR
$plan->setStrategy('Avoid');   // Avoid risk (eliminate activity)
// OR
$plan->setStrategy('Transfer'); // Share risk (insurance, outsourcing)
```

##### 6.4.2: Risk Treatment Plan
**Requirement:** Document treatment actions, resources, timelines

**Implementation:**
```php
$plan = new RiskTreatmentPlan();
$plan->setRisk($risk);
$plan->setStrategy('Reduce');
$plan->setDescription('Implement MFA, strong password policy (12+ chars), regular access review');
$plan->setTargetDate(new \DateTime('+60 days'));
$plan->setResponsiblePerson('IT Security Manager');
$plan->setEstimatedCost(15000);  // MFA solution cost
$plan->setVerificationMethod('Penetration test after implementation');

// Link ISO 27001 controls (Data Reuse)
$controlMFA = $controlRepository->findByAnnexId('A.5.17');  // Authentication information
$controlPassword = $controlRepository->findByAnnexId('A.5.18');  // Access rights
$plan->addControl($controlMFA);
$plan->addControl($controlPassword);

$plan->setStatus('Planned');
```

##### 6.4.3: Residual Risk Assessment
**Requirement:** Calculate risk after treatment

**Implementation:**
```php
// Update control effectiveness
$controlMFA->setEffectiveness(90);  // MFA is highly effective
$controlPassword->setEffectiveness(70);

// Calculate residual risk (automatic)
$residualRisk = $riskService->calculateResidualRisk($risk);
// Residual likelihood = 3 × (1 - 0.80 average effectiveness) = 0.6 → 1 (Rare)
// Residual risk = 5 × 1 = 5 (Medium) ✓ Within appetite (threshold 12)

$risk->setResidualImpact(5);  // Impact unchanged
$risk->setResidualLikelihood(1);  // Likelihood reduced
$risk->setResidualRisk(5);
```

##### 6.4.4: Risk Acceptance
**Requirement:** Formal acceptance by risk owner

**Implementation:**
```php
if ($risk->getTreatmentStrategy() === 'Accept') {
    // Create formal acceptance (ISO 27005 requirement)
    $acceptance = $acceptanceWorkflowService->createAcceptanceRequest($risk,
        'Residual risk 5 is below appetite threshold 12. Cost of further treatment (€50k) exceeds potential loss (€20k).'
    );

    // Determine approval level based on residual risk
    $approvalLevel = $acceptanceWorkflowService->determineApprovalLevel($risk);
    // Residual risk 5 → Approval Level 1 (Manager sufficient)

    $acceptance->setApprovalLevel($approvalLevel);
    $acceptance->setExpiryDate(new \DateTime('+1 year'));  // Annual review

    // Workflow sends notification to approver
    // After approval:
    $acceptanceWorkflowService->approveAcceptance($acceptance, 'Jane Doe - IT Manager');
    $risk->setStatus('Accepted');
}
```

**Compliance Check:**
```
✅ Treatment strategy selected and justified?
✅ Treatment plan documented with actions, timeline, owner?
✅ Residual risk calculated after controls?
✅ Residual risk formally accepted if above tolerance?
✅ Approval obtained at appropriate level?
```

#### Clause 6.5: Risk Communication and Consultation
**Requirement:** Communicate risk info to stakeholders

**Implementation:**
- `RiskReportService->generateExecutiveSummary()` - Board-level summary
- `RiskReportService->generateRiskRegister()` - Detailed register for risk committee
- `RiskDashboardService` - Real-time dashboards for ongoing monitoring

#### Clause 6.6: Risk Monitoring and Review
**Requirement:** Continuous monitoring, regular reviews

**Implementation:**
```php
// Schedule periodic reviews
$risk->setNextReviewDate(new \DateTime('+6 months'));

// Find risks requiring review
$overdueReviews = $riskService->findRisksRequiringReview(new \DateTime());

// Monitor treatment plan progress
$overduePlans = $treatmentPlanService->getOverduePlans($tenant);

// Check expiring acceptances
$expiringAcceptances = $acceptanceWorkflowService->checkExpiringAcceptances(30);  // Next 30 days
```

---

## ISO 31000 Framework Integration

### Principles (Clause 4)
ISO 31000 defines 8 principles for effective risk management:

1. **Integrated** - Risk management embedded in all activities
   - Implementation: Multi-tenant risk context, cross-entity relationships (Asset, Control, Process)

2. **Structured and Comprehensive** - Systematic approach
   - Implementation: 5×5 risk matrix, formal workflows, standardized categories

3. **Customized** - Aligned to organization's context
   - Implementation: Configurable RiskAppetite per tenant, customizable impact criteria

4. **Inclusive** - Stakeholder engagement
   - Implementation: Risk owner assignment, approval workflows, communication tools

5. **Dynamic** - Responsive to change
   - Implementation: Continuous monitoring, incident-driven likelihood adjustment

6. **Best Available Information** - Based on data and analysis
   - Implementation: **Data Reuse** from Assets, Incidents, Controls (historical + real-time)

7. **Human and Cultural Factors** - Considers behavior
   - Implementation: Training requirements tracking, awareness campaigns, role-based access

8. **Continual Improvement** - Lessons learned
   - Implementation: Incident → Risk validation loop, treatment effectiveness tracking

### Framework (Clause 5)

#### 5.3: Design of Framework
**ISO 31000 Requirement:** Establish risk management framework

**Application Implementation:**
- **Policy**: Risk Management module in Admin settings
- **Accountability**: Risk owners, approval levels, tenant hierarchy
- **Integration**: Embedded in ISMS (ISO 27001), BCMS (ISO 22301)
- **Resources**: RiskService, RiskMatrixService, 8 specialized services
- **Communication**: RiskReportService, dashboards, notifications

#### 5.4: Implementation
**ISO 31000 Requirement:** Implement risk management throughout organization

**Workflow Example:**
```
1. Context (5.4.2):
   - Define RiskAppetite for tenant
   - Configure risk matrix thresholds

2. Integration (5.4.3):
   - Link Risks to Assets (asset-centric approach)
   - Link Risks to BusinessProcesses (BCM integration)
   - Link Risks to Controls (ISO 27001 Annex A)

3. Accountability (5.4.4):
   - Assign risk owners
   - Define approval authority (Level 1-3)

4. Communication (5.4.5):
   - Generate executive summaries
   - Risk dashboards for management
   - Regular risk register reviews
```

#### 5.5: Evaluation
**ISO 31000 Requirement:** Monitor framework effectiveness

**KPIs in Application:**
```php
$dashboard = $riskReportService->generateRiskDashboard($tenant);
// Returns:
// - Total risks by level (Critical, High, Medium, Low)
// - Treatment plan completion rate
// - Residual risk trend (improving/worsening)
// - Risks exceeding appetite
// - Overdue treatments
// - Acceptance expiration rate
```

#### 5.6: Improvement
**ISO 31000 Requirement:** Continually improve framework

**Feedback Loops:**
1. **Incident → Risk**: Incidents validate or adjust risk assessments
2. **Control → Residual Risk**: Control effectiveness drives improvement
3. **Exercise → Treatment**: BC exercises identify gaps in treatment plans
4. **Audit → Process**: Internal audits improve risk management process

---

## ISO 27001 Integration

### Annex A Controls
The application includes all 93 ISO 27001:2022 Annex A controls in the `Control` entity.

**Risk-Control Mapping:**
```php
// Link risks to Annex A controls
$risk->addControl($controlA817);  // A.8.17 - Cloud services security

// Suggest relevant controls automatically
$suggestedControls = $treatmentPlanService->suggestControls($risk);
// For category 'Technical', threat 'Data Loss':
// Returns: A.8.13 (Backup), A.8.18 (Configuration management), A.8.24 (Cryptography)
```

**Control Effectiveness Impact:**
```php
// Control effectiveness reduces residual risk
$control->setImplementationStatus('Implemented');
$control->setEffectiveness(85);  // 85% effective

// Residual likelihood = inherent × (1 - effectiveness)
// If inherent likelihood = 4, residual = 4 × (1 - 0.85) = 0.6 → 1 (Rare)
```

### Clause 6.1.2: Information Security Risk Assessment
**ISO 27001 Requirement:** "The organization shall define and apply an information security risk assessment process"

**Application Implementation:**
- Risk assessment process defined through RiskService + RiskMatrixService
- 5×5 risk matrix meets "reproducible results" requirement
- Asset-centric approach aligns with ISO 27001 Clause 6.1.2(c)

### Clause 6.1.3: Information Security Risk Treatment
**ISO 27001 Requirement:** Define risk treatment process, select controls

**Application Implementation:**
- RiskTreatmentPlanService implements formal treatment planning
- Control selection from Annex A (93 controls available)
- Residual risk acceptance workflow per 6.1.3(e)
- Statement of Applicability (SoA) links controls to risks

### Clause 8.2: Information Security Risk Assessment
**ISO 27001 Requirement:** Perform risk assessments at planned intervals

**Application Implementation:**
```php
// Scheduled reviews
$risk->setNextReviewDate(new \DateTime('+6 months'));

// Trigger-based reviews
if ($newIncident) {
    $riskProbabilityAdjustment->adjustLikelihood($risk);  // Re-evaluate
}

// Find overdue reviews
$overdueReviews = $riskService->findRisksRequiringReview(new \DateTime());
```

---

## Common Risk Management Workflows

### Workflow 1: New Risk Identification (ISO 27005 Clause 6.3.1)

**User Request Patterns:**
- "Help me identify risks for our new cloud migration project"
- "What risks should I consider for our customer database?"
- "Create a risk assessment for Asset X"

**Agent Response:**
1. **Analyze Context** - Read Asset/Business Process details
2. **Suggest Threat Sources** - Based on asset type and category
3. **Identify Vulnerabilities** - Check control coverage gaps
4. **Draft Risk** - Pre-fill fields using Data Reuse
5. **Link Related Data** - Connect to Assets, Controls, Incidents

**Example:**
```
User: "Help me assess risks for our customer database (Asset #42)"

Agent Actions:
1. Read Asset #42 details:
   - Type: Database Server
   - Contains: 50,000 customer records (personal data)
   - CIA: C=5, I=5, A=4
   - Monetary Value: €200,000
   - Location: AWS eu-central-1

2. Suggest risks based on asset profile:
   a) Unauthorized access (External threat)
   b) Data breach (GDPR Art. 32 violation)
   c) Ransomware attack (Malware threat)
   d) Accidental deletion (Human error)
   e) Cloud provider outage (Third-party dependency)

3. For Risk (a) - Draft pre-filled risk:
   - Name: "Unauthorized Access to Customer Database"
   - Category: Technical
   - Threat Source: External
   - Vulnerability: "Check current controls for A.5.15 (Access control)"
   - Assets: [Asset #42] (linked)
   - Financial Impact: €200,000 + GDPR fine (€10M or 2% revenue)
   - Compliance Impact: GDPR Art. 32 (Security), Art. 33 (Breach notification)
   - Impact: 5 (Critical) - based on personal data + high value
   - Likelihood: 3 (Possible) - check incident history for similar attacks

4. Present to user for review and confirmation
```

### Workflow 2: Risk Assessment Update (ISO 27005 Clause 6.6)

**User Request Patterns:**
- "Update risk likelihood based on recent incidents"
- "Recalculate residual risk after implementing MFA"
- "Review risk #15"

**Agent Response:**
1. **Check Incident History** - Has new incident data emerged?
2. **Check Control Status** - Have controls been implemented/updated?
3. **Recalculate Scores** - Apply Data Reuse services
4. **Compare to Appetite** - Does risk still meet acceptance criteria?
5. **Recommend Actions** - Treatment plan updates if needed

**Example:**
```
User: "Risk #15 (Phishing Attack) needs review after 3 incidents this month"

Agent Actions:
1. Read Risk #15 current state:
   - Inherent: Impact 4, Likelihood 3, Score 12 (H

…(truncated)