Clateway Insights platform · Nederlands
ISO 27001 risk register and risk assessment
The Clateway risk register follows ISO 27001 clauses 6.1.2, 6.1.3, 8.2 and 8.3. You set your own method (3×3, 4×4 or 5×5 scale, impact dimensions, score bands and risk appetite), and every risk gets an inherent and residual score, an owner, controls and a treatment plan.
Instead of starting from a blank sheet, the platform suggests risks from your own data: systems, data sources, business processes, core vendors, known-exploited vulnerabilities and audit findings. Each suggestion comes with scenario, scores, Annex A controls and treatment actions.
Request access to Clateway Insights
Features
- Inherent and residual heat maps with click-to-filter
- Risk appetite, score bands and review intervals per level
- Treatment plans with actions that become tasks
- Formal risk acceptance with justification, end date and role checks
- Links to the Statement of Applicability and audit findings
- Immutable history of every change
- Word risk assessment report, risk treatment plan and Excel export
- Import from CSV or Excel
Frequently asked questions
What should an ISO 27001 risk register contain?
For each risk: the asset or process, threat, vulnerability and consequence, owner, likelihood and impact before and after controls, the controls applied, the treatment decision and the review date. Clateway records all of these and keeps the history.
Can I import my existing risk register from Excel?
Yes. Upload a CSV or Excel file, map the columns once and the register imports or updates risks by reference.
Related insights
- Regulation as Architecture - DORA, NIS2, and the EU AI Act
- AI Agent Security: The New Identity Management Frontier Demanding C-Suite Attention
- Approach and architecture of GenAI and Enterprise data
- NIS2 - Executive Implementation Brief
- THE NIS2 DIRECTIVE - A Complete Article-by-Article Reference and Explanation
- The Technology Leadership Platform: a working guide for digital leadership teams
Compare vendors
Key terms explained
- What is ISO 27001?
- What is a Statement of Applicability (SoA)?
- What is a risk register?
- What is Risk appetite?
- What is GRC (governance, risk and compliance)?
Related solutions
- GRC and compliance software with AI – AI-powered GRC software: generate ISO 27001, NIS2, DORA and GDPR policies, run your Statement of Applicability, controls, audit findings and management review…
- Vulnerability management – Scan your systems and technologies for CVEs, prioritise with EPSS and CISA KEV, track SLAs, sync Dependabot alerts and watch SaaS vendor advisories in one…
- Vendor and third-party risk management – Third-party risk management: vendor registry, risk scoring, breach history, adverse media monitoring, fourth parties, contract lifecycle and renewal alerts.