Features included from Business: Risk management, compare packages
Risk management
Identify, assess and treat risks with the method that suits your company, connected with assets, vulnerabilities and measures.
Almost every framework requires a risk-based approach, and the assessment has to fit the assets, vulnerabilities and measures you already document.
How Complass helps
Risk register with context
Risks linked to assets, zones and locations, coupled with vulnerabilities, incidents and the Statement of Applicability.
Method of your choice
Matrix from 3 × 3 to 5 × 5 with templates per ISO/IEC 27005, IEC 62443-3-2 and BSI Standard 200-3. Qualitative, quantitative as expected annual loss in euros with ranges (P50/P90), or combined.
Risk appetite and acceptance
Freely definable risk appetite and acceptance criteria with approval levels. From the class you set, and always above the risk appetite, a second person has to agree (four-eyes principle).
Treatment with cost-benefit
Measures and tasks per risk, residual risk with the implemented measures, target risk after all planned measures with approval by the risk owner, and cost-benefit view (ROSI). Risk treatment plan and risk assessment report as PDF.
Heat map and zone risk assessment
Heat map for inherent, residual and target risk, risk assessment per zone per IEC 62443-3-2. Attack techniques per MITRE ATT&CK can be recorded.
Legal and normative basis
- § 30 BSIG§ 30 BSIG Risikomanagementmaßnahmen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, geeignete, verhältnismäßige und wirksame technische und organisatorische Maßnahmen, die in Absatz 2 konkretisiert werden, zu ergreifen, um Störungen der Verfügbarkeit, Integrität und Vertraulichkeit der informationstechnischen Systeme, Komponenten und Prozesse, die sie für die Erbringung ihrer Dienste nutzen, zu vermeiden und …Open original (gesetze-im-internet.de) ↗
- Art. 21 NIS2-RichtlinieArticle 21 NIS 2 Directive Cybersecurity risk-management measures1. Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other …Open original (EUR-Lex) ↗
- Art. 13 CRAArticle 13 Cyber Resilience Act Obligations of manufacturers1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I. 2. For the purpose of complying with paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- ISO/IEC 27001:2022, 6.1 und 8.2–8.3
- ISO/IEC 27005
- IEC 62443-3-2
- BSI-Standard 200-3
MITRE ATT&CK as framework and threat picture
MITRE ATT&CK describes how attackers actually operate. Complass connects this public knowledge base with your measures, vulnerabilities and incidents – configurable per company, for IT, OT or both.
Heat map tactic × technique
Enterprise for IT, ICS for controllers and plants: which attack techniques do your measures cover, where are the gaps? Filters by platform and asset type such as PLC, HMI or engineering workstation.
Mitigations as requirements
Status, justification, evidence and tasks per mitigation, pre-filled from your implementation of ISO 27001 Annex A and IEC 62443-3-3.
Vulnerabilities, incidents, risks
Techniques enabled by open vulnerabilities, observed techniques on incidents and risk scenarios created directly from a technique.
© The MITRE Corporation. ATT&CK® is a registered trademark of The MITRE Corporation.
Frequently asked questions
Qualitative or quantitative – which is right?
Both are permissible. Many companies start with a matrix and additionally assess important risks in euros. Complass supports both approaches and their combination.
Can we keep our existing method?
Yes, you define the matrix size, levels, risk appetite and acceptance criteria yourself, or you start with a template.
How does risk management relate to the frameworks?
Risk treatments refer to measures and requirements, e.g. in the Statement of Applicability. This makes it traceable why a measure is implemented.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.