Assess, decide and report
We rate each risk, agree a treatment and an owner, and report to your board. We can also run it as a service, alone or within governance, risk and compliance (GRC).
Enterprise risk management services in India
Risk management that ends in a decision — with an owner for every risk.
You can't remove every risk, and a program that pretends otherwise wastes money. We help you decide which risks to accept, which to reduce and which to transfer, and who owns each one. You keep a record of those choices and the evidence that someone made them on purpose.
- A named owner for every risk
- Board reports in business terms
- We reply within one working day.
- ISO 31000
- NIST RMF
- FAIR
- ISO 22301
- NIST AI RMF
In brief
- What it is
- Deciding what to do about each risk to your business: accept it, reduce it or transfer it (pass the cost on, for example through insurance or a contract). One named person owns each choice.
- Why it matters
- You can't fix everything at once. Your board needs to know where to spend first, and who answers for each risk.
- What you get
- A short register with an owner on every line, a treatment plan for each risk, and board reports in business terms.
What we cover
The register is only one part of risk work.
We also assess risks, plan treatments, report to your board, review your vendors and plan for continuity. Pick the page that matches your question, or ask us and we'll suggest a first step.
Vendors, continuity and AI
What your suppliers can reach, how you keep running through a disruption, and the new risks that AI brings.
Certifications and laws
If a customer or regulator names a standard or law, the register and owners you already have become your starting point. We prepare you. The certificate or report comes from an accredited certification body (ISO 27001) or a licensed CPA firm (SOC 2). We are neither.
Business continuity and disaster recovery. We build continuity plans to ISO 22301, not from a template, so a regulated firm in India can show evidence for them. You get a business impact analysis (which services matter most if they stop), recovery time objectives (how fast each must be back) and plans to withstand a disruption and recover with minimal business impact.
Risk management is part of our governance, risk and compliance services.
What a risk assessment and a vendor review cover
- Information security risk assessment. We identify the threats and weaknesses that affect your information assets and score each one qualitatively (in words) and quantitatively (in numbers), so risks sort by business impact and likelihood.
- Third-party vendor risk. We assess the security posture and compliance status of your suppliers and technology vendors, looking for concentration risk, over-broad access and contract gaps before they become incidents.
A position we hold
Most risk registers are decoration.
A register earns its place only if it changes what someone decides.
A register with sixty entries, all rated amber and updated once a year by one person, changes no decision. It exists so a box can be ticked.
A useful register is short. Every line has an owner and says what would have to be true for its rating to change. It's reviewed when something happens, not when the calendar says so. It should tell your board which three things to spend money on this year. If it turns out to be wrong, it should be clear why.
Sort each risk by what you'll do about it
We plot each risk on a five-by-five grid of likelihood against impact. The grid is only useful if risks land in different cells. Read it by treatment band, not by color: the question is what you'll do about a risk, not how alarming it looks.
- Accept. Unlikely and low impact. You record the decision and its owner.
- Monitor. You keep it on the register and re-rate it when something changes.
- Reduce. A specific control, an owner and a deadline.
- Critical: act now or transfer. The top-right corner. Reduce the risk straight away, or pass it on.
A live example: staff pasting customer data into consumer AI tools, assessed as likely and major. It needs a treatment policy straight away. A register with nothing in the top-right corner usually means the scoring was too generous, not that the business is too safe.
Where a number genuinely helps, we use FAIR (Factor Analysis of Information Risk) to put a defensible financial range on a scenario. Where it doesn't, we say so rather than invent precision from a five-point scale.
How the grid is scored
Likelihood runs rare, unlikely, possible, likely and almost certain. Impact runs low, minor, moderate, major and severe. The 25 cells fall into four bands: accept in the bottom-left corner, then monitor, reduce, and critical or transfer in the top-right corner.
ISO 31000, the NIST RMF and FAIR in detail
ISO 31000. Our risk practice follows ISO 31000, an internationally recognized framework for building risk management into how an organization is governed.
NIST RMF. For organizations that need to align with US federal security standards, we implement the NIST Risk Management Framework: all seven steps of SP 800-37 Rev. 2 (prepare, categorize, select, implement, assess, authorize and monitor), not the six of the superseded revision.
FAIR. Where cyber risk needs a financial figure, we apply FAIR to produce defensible, board-ready financial estimates.
Find the right page
Find the page that answers your risk question.
Risk work usually starts with a question from your board, a customer or a regulator.
- Our board wants to see, regularly, which risks moved and why.Risk management as a service
- What can our vendors reach, and what do they do with our data?Third-party risk
- Several of our tools may run on the same AI model provider.AI vendor risk
- How fast must each service be back after a disruption?Business continuity planning
- Where do we stand against NIST CSF 2.0, in terms our board understands?NIST CSF 2.0
- We want GRC run as an ongoing program, not a one-off project.GRC as a service
- How do we keep compliance evidence current between audits?Compliance as a service
- A customer or regulator has named a standard or law.GRC and compliance
How a risk assessment runs
Five steps, and every risk leaves with an owner.
We choose the framework (ISO 31000, the NIST RMF or FAIR) by who will read the output, then work through the same five steps.
Identify
We list the threats and weaknesses that affect your information assets, including the access your vendors hold.
Rate
Each risk is scored by business impact and likelihood. Where a number genuinely helps, FAIR gives the scenario a financial range.
Decide
You choose to accept, reduce or transfer each risk. To reduce one, we name the controls, who owns them and by when. We also agree how much risk will be left afterwards (the residual risk), and check it against your risk appetite: how much risk you're willing to carry.
Report
Board reports put technical findings in business terms, so whoever signs the budget can see what they're deciding.
Review
Review the register at least once a year, and again straight away when something big changes, such as a new product or an incident.
New in the register
Five AI risks that belong in your register.
Boards hear AI risk pitched either as science fiction or as nothing to worry about. The real exposures are more ordinary and easier to manage.
Data leaving the building
Staff pasting customer data into consumer AI tools. It's usually the largest live AI exposure in a company that hasn't deployed any AI itself.
Decisions you can't explain
If a model influences credit, hiring or pricing, someone will eventually ask why it decided what it did. Whether you can answer is a governance question, not a technical one. See AI governance and AI model risk management.
Vendor concentration
Four products in your stack quietly calling the same model provider: a single point of failure your vendor register probably doesn't show. See AI vendor risk.
Agents with real permissions
This is where AI risk becomes operational risk. If an AI agent can act, the damage it could do belongs in the register. See AI security testing.
Regulatory drift
The EU AI Act and India's DPDP Act both keep changing. Give someone the job of following them, rather than discovering a change through a customer questionnaire.
How we assess them
We assess these exposures against the NIST AI Risk Management Framework. Each gets a rating, a treatment and an owner, like any other risk in your register.
What this work does not include. A risk assessment isn't an audit. We aren't an auditor or a certification body, so it doesn't come with a certificate. The decisions stay yours: we prepare them, and your named owners make them. Finding and fixing technical weaknesses is our defensive cybersecurity work.
FAQ
Questions about risk management.
Frameworks, refresh cycles, vendors and AI. For anything else, ask us directly.
A vulnerability assessment tells you which weaknesses in your systems are exploitable right now. A risk assessment tells you what it would cost you if an attacker used one, and whether that justifies the spend to fix it. You need both, and they answer to different audiences: the findings go to engineering, the assessment goes to whoever signs the budget. The first is part of our vulnerability management work.
ISO 31000 for the overall approach, NIST RMF where alignment with US federal expectations matters, and FAIR when a scenario needs a defensible financial range rather than a color. We pick based on who is going to read the output.
Annually as a baseline, and immediately after anything that changes the picture: a new product, an acquisition, a major vendor change, or an incident. A register reviewed only on schedule is usually out of date by the time anyone reads it.
Yes, and it is increasingly the larger exposure. We look at concentration, what access each vendor actually holds versus what they need, contractual gaps around breach notification, and what happens operationally if one disappears at short notice.
Yes, and it is the fastest-growing part of this work. The exposures that matter are usually staff pasting data into consumer AI tools, decisions nobody can explain, model vendor concentration, and agents holding permissions nobody reviewed. We assess against the NIST AI Risk Management Framework.
Let's talk
Know what you're actually accepting.
Tell us what worries you. We'll come back with a register your board can act on, and a note on which three things are worth spending money on this year. We reply within one working day.