Risk Catalog
RiskCatalog
Experimental
A RiskCatalog is a structured collection of documented risks that may affect an organization, system, or service. It provides a centralized reference for risks that can be mapped to threats and referenced by policies when documenting how those risks are mitigated or accepted.
metadata object Required
metadata provides detailed data about this catalog
title string Required
title describes the purpose of this catalog at a glance
extends array[ArtifactMapping]
extends references catalogs that this catalog builds upon
groups array[RiskCategory]
groups narrows the base groups to risk categories with appetite and severity boundaries
imports array[MultiEntryMapping]
risks array[Risk]
risks is a list of risks defined by this catalog
RiskCategory
Experimental
RiskCategory describes a grouping of risks and defines appetite boundaries
appetite RiskAppetite Required
appetite defines the acceptable level of risk for this category
description string Required
description explains the significance and traits of entries to this group
id string Required
id allows this entry to be referenced by other elements
title string Required
title describes the purpose of this group at a glance
max-severity Severity
max-severity defines the risk tolerance boundary: the highest severity the organization will accept within this category
Severity
Severity defines the assessed level of a risk based on its potential impact and likelihood
- Type:
string
RiskAppetite
RiskAppetite defines the acceptable level of exposure for a risk category
- Type:
string
Risk
Experimental
A Risk represents the potential for negative impact resulting from one or more threats.
description string Required
description explains the risk scenario
group string Required
group references by id a catalog group that this risk belongs to
id string Required
id allows this risk to be referenced by other elements
severity Severity Required
severity describes the assessed level of this risk
title string Required
title describes the risk
impact string
impact describes the business or operational impact
owner RACI
owner defines the RACI roles responsible for managing this risk
rank integer
rank optionally orders risks for the same catalog (e.g. when several share the same severity). Lower values mean higher relative importance. Omitted when the four severity levels are enough. When set, each value must be unique among all risks in the catalog that specify rank.
threats array[MultiEntryMapping]
threats link this risk to Layer 2 threats