A risk register that is current, owned and readable by your board
Most risk registers are a spreadsheet somebody updated before the last audit. NorthIron gives you a live register seeded from a curated library, with an owner and a treatment plan on every entry, and acknowledgement captured from the people accountable.
What this looks like today
The register is written once and then abandoned
It gets built for the certification, filed, and opened again eleven months later when the surveillance audit is scheduled.
Starting from a blank sheet is the hard part
Teams spend weeks arguing about what belongs on the register before they get anywhere near treating anything.
Nobody actually owns a risk
A register without a named owner and a date is a list of opinions.
A register that moves when your posture moves
Start from a library, not a blank page
NorthIron ships 79 pre-defined risks across 17 categories, covering the ground most organisations need before they add anything specific to their business. Pull a library risk in by code, or define a custom one under the relevant category.
Impact, likelihood, treatment, owner, date
Each risk carries a current impact and likelihood, a treatment decision, a named owner, a due date and treatment notes. The residual position updates as treatment progresses.
Acknowledgement without the chase
Risk owners acknowledge through a magic link. No new account, no password reset, no forwarding the mail to somebody who has a log-in. The acknowledgement is timestamped and becomes evidence.
- Bring an existing register in by CSV, mapped to library risks by code
- Custom risks sit alongside library risks under the same categories
- Risks link to the atomic controls that treat them
Risks connected to controls
A risk links to the atomic controls that treat it, so a control failure shows up as a change in risk position rather than as a separate finding nobody connects to anything.
You start with a register, not a blank sheet.
79 risks across 17 categories, ready to pull in by code. The ones marked are the ones a first programme almost always ends up treating.
Not a table that exists to satisfy a clause
Risk on most platforms is a static register kept so an auditor can be shown one. Here it is wired into the same control and evidence layer as the rest of the programme, which is what lets the register move on the day your posture does.
What changes once this is running
- A working register in days rather than weeks
- Named ownership and a dated treatment on every risk
- Timestamped acknowledgement without provisioning accounts
- A direct line from a control failure to a risk position
- Board reporting from live data
Questions we are asked about this
Can we use our own risk taxonomy?
Yes. The library is a starting point. Custom risks sit alongside library risks under the same categories, and an existing register can be imported in bulk.
How does a magic link stay secure?
Links are issued to a named person for a specific acknowledgement, are time bound, and record who acted and when. The trade-off is deliberate: the alternative is provisioning accounts for occasional users, which in practice means the acknowledgement never happens.
Does this satisfy the ISO 27001 risk clause?
The register, the methodology, the treatment plan and the acknowledgement record are the artefacts an auditor looks for, and for the Statement of Applicability alongside them. NorthIron holds them and links them to the controls.
See it against your own programme
The call opens the product, not a deck. A practitioner walks you through this capability with your situation in front of them.