Product
Assess cyber risks, put security controls into practice and review the exposure that remains. Connect risks to your systems, information and suppliers, then track control implementation, review outcomes and residual risk with clear ownership.
The outcome
Know which controls are implemented, whether they are working and whether residual cyber risk needs further treatment or an accountable acceptance decision.
How it helps
This product connects with the wider Apollo platform, so information can support action, evidence and reporting without being entered again.
Feature 1
Bring the affected information, systems and suppliers into the risk record. A data breach risk, for example, becomes easier to assess when the relevant records, cloud supplier and access controls are connected.
Feature 2
Select relevant controls from the library or your existing register, link them to the risk and assign responsibility for implementation. Track what is planned, underway or implemented, with treatment tasks to close the gaps.
Feature 3
Review whether implemented controls are operating as intended, then reassess the likelihood and impact of the risk. Record the remaining exposure and the next decision: further treatment, continued monitoring or acceptance by the accountable risk owner. Planned controls should not be treated as if they are already reducing risk.
What is included
Use the product you need now while keeping its records, work and evidence ready for related products across Apollo.
Included features
Connected platform
See the related products and solutions that use the same connected information.
Product
Turn cyber security framework assessments into an ongoing improvement process. Keep requirement responses, security controls, evidence and remediation work connected so your team can explain its current position.
Explore productProduct
Keep your IT and security policies aligned with the way your organisation works. Bring policy content, technical review, approval, publication and staff acknowledgements into one governed process.
Explore productCustomer proof
See how customers use this product as part of a broader security, governance or compliance outcome.
Capabilities in this product
Explore the workflows and detailed features behind each capability. Shared capabilities may also support other Apollo products.
Maintain the risks the organisation manages, with ownership, scoring, treatment and connected context in one current register.
Explore capabilityMaintain the measures used to reduce risk and support compliance requirements, including ownership, implementation and review.
Explore capabilityMaintain the information, systems, services and other resources the organisation depends on.
Explore capabilityMaintain the third parties the organisation relies on, their services, data context, ownership and review status.
Explore capabilityConnect risks, obligations, controls, assets, suppliers, policies and work without rebuilding the same context.
Explore capabilityAssign, prioritise and track responsibilities across all aspects of your GRC program.
Explore capabilityTurn current records into clear progress views for teams, executives and boards.
Explore capabilityQuestions and answers
Practical answers to common questions about managing this responsibility well.
Record the risk scenario, affected systems or information, likely consequences, owner, existing controls and assessed exposure. Include the treatment decision and review date so the register supports action rather than becoming a list of threats.
Inherent risk describes exposure before considering the controls in the assessment. Residual risk describes the exposure that remains after those controls are considered. Record the assumptions behind both ratings so reviewers can understand the judgement.
Base the residual risk assessment on controls that are implemented and operating, with evidence to support the judgement. A planned control is a treatment action, not an existing reduction in exposure. Review control effectiveness, reassess likelihood and impact, and record whether the remaining risk needs further treatment or an accountable acceptance decision.
Assign the risk to someone who can make or escalate decisions about the affected activity. Technology staff may operate the controls, while the accountable risk owner decides whether treatment and remaining exposure are appropriate within the organisation's governance process.
Show material exposure, significant changes, treatment progress and decisions requiring attention. Keep the connection to business impact clear, and identify overdue reviews or actions so leaders can see where intervention is needed.
Book a focused demonstration and we will show how the product fits your current responsibilities, existing information and next practical priorities.
