Re-using existing causes, events, consequences, and treatments
Re-use is an excellent opportunity to save time in your DRA. The "Existing"-button lets you add to your assessment from existing data and is available for causes, events, consequences, and treatments. Clicking this button lets you access and add from the results of previous risk assessments. You can only re-use data from risk assessments that your user has access to.
The "Existing"-button is always visible in for the events, but you have to highlight an event for the button to become visible for causes and consequences, as illustrated in the picture below. Copying a cause, event, or consequence will not include the associated treat
A risk in Diri illustrated with available functionality for adding from existing risk assessments.
If you wish to add an existing treatment, you open the cause/consequence in question and click the "Add existing"-button below the "New"-button. This action will show you a list containing the existing treatments from both the current risk assessment and other objects that you have access to. You can sort the list on all the available variables, illustrated below.
Global and system specific controls
of the most complex issues in a risk management system is the
many-to-many relationships between risk assessment objects (IT systems)
and security controls. It is not uncommon that a control (treatment) has
implications for the risk of many IT systems. Managing this is an
essential issue as it prevents the same treatment from being registered
and recommended multiple times.
We call it a global control
when a unique control is included in more than one assessment. Typical
global control mechanisms are single sign-on solutions that provide
access to many systems and network firewalls that protect multiple
systems and servers. A system-specific control only applies to one
specific IT system.
controls can now easily be added in Diri via the Organizational risk
assessment. System-specific treatments can also be made global by
including them in new risk assessments. The treatment now lists how many
risk assessments it is included in and the number of risks it
mitigates. A premise for re-using existing treatments is that the user
can access the original analysis where the control resides.
A warning is displayed on treatments connected to more than one risks and assessments.
Many-to-many relationships in the DRA
A cause can lead to several events and an event can lead to many consequences. The DRA allows you to quickly create multiple connections between these elements. How to add an existing treatment to multiple elements is described above. There are primarily two ways of connecting elements in Diri:
Drag and drop
You can drag and drop causes and consequences and connect them to existing events. Grab the chain icon on the cause or consequence and drop it onto the event that you want to connect, as illustrated in the figure below. The number below the chain icon displays how many connections the item has to events.
Making many-to-one connections by grabbing the chain icon of a cause and dropping it on the connected event.