Archer Risk Management
Solution Design Document
Version 0.1
Submitted by
23rd Oct 2014
Risk Management Solution Design Document
Document Control
Title Archer Risk Management – Solution Version 0.1
Design Document
Document Steward Status Draft
Document Owner Date Raised 23rd Oct
2014
Document Review and Approval
Name Title Signature Date Status
Imran Abdulla Al Head of IT
Marzooqi Security
Version Changes Name
Number
0.1 Initial Draft based on discussions with the Wipro Consulting Services
CITD Team
Risk Management Solution Design Document
Contents
Risk Management.................................................................................................................................4
Requirements from Risk Management..........................................................................................5
High Level Design.................................................................................................................................6
Risk Management & Solution level relations.............................................................................12
Risk Documentation/Review Stages.............................................................................................14
Field level Details of Applications.................................................................................................15
Risk Management Solution Design Document
Risk Management
Archer Risk Management enables the organization to proactively address reputational, financial, and
operational and IT risks against its corporate/Information Security objectives. This web-based solution
delivers a central management system for identifying risks, evaluating their likelihood and impact,
relating them to mitigating controls and tracking their resolution. Archer Risk Management allows the
Organization to manage a comprehensive Risk program enabled by a central risk repository with project
management capabilities, key risk indicators and loss events. It can also leverage pre-built risk
assessments or create organization specific Assessment to deliver targeted risk assessments to evaluate
identified risks within the environment. Management of risk treatment processes is built in allowing the
team to manage the full lifecycle of risk management.
As per the initial discussions with ADCO Compliance team, the applications in Risk Management Solution
are mentioned below:
1. Risk Register
2. Risk Project
3. Question Library ( Assessment Questionaries’)
4. Finding
5. Remediation Plans
6. Exception Request
7. Quarterly Review
Risk Management Solution Design Document
Requirements from Risk Management
The following are ADCO’s requirements from Risk Management Solution in Archer:
Ability to define a risk assessment (purpose, scope, participants, risk levels, questions to be
answered, etc.)
Provide a centralized repository to maintain standards, compliance requirements and leading
practices as per the ADCO compliance requirement.
Automatically notify personnel responsible for Risk management so that they can act on
mitigation plan to address the risk.
Integrate data from the RSA Archer Enterprise Management solution to prioritize the
implementation of remediation or workarounds based on the business criticality of a technology
asset.
Ability to provide aggregated reporting and dashboarding on risk assessments.
Capability for automated alert generation or escalations in case of non compliances/ delays in
mitigation, etc
Create remediation plans and track actual and estimated remediation costs and timeframes.
The fulfillment of the above requirements is achieved using design detailed in the sections below. The
design of Risk management is provided in the High Level Design section.
The Risk Documentation/Review Stages section illustrates the workflow for Risk management to be
achieved through Archer.
High Level Design
Risk Management Solution Design Document
Below High Level Design diagram for Risk Management solution depicts the relationship among key
applications. A brief description of these applications is mentioned below the diagram.
Figure 1: Risk Management High Level Design Diagram -1
Risk Management Solution Design Document
Risk Register
The Risk Register application serves as the corporate controlled library of risks utilized by the entire
organization. It allows the team to capture the base data for a given risk statement and link risks to
processes, objectives, key risk indicators, financial losses and mitigating control procedures.
Through the Risk Register application, team can:
Document risks, including their nature, driver, source, manager and related business units.
Evaluate risk impact and likelihood.
Perform quarterly reviews to update the status of risks on a periodic basis.
Document the response to the risk statement, and track the status of response activities.
Monitor inherent risk, which is calculated based on risk likelihood and impact.
Track residual risk, which is calculated based on response activities.
Link risks to corporate objectives, quarterly risk reviews, key risk indicators, related financial loss
events and mitigating control procedures.
Figure 2: Risk Management High Level Design Diagram -2
Risk Management Solution Design Document
Risk Project
The Risk Project application enables the risk function to manage the operational activities of the risk
program through project management and an integrated risk methodology. The Risk Project
application provides risk analysts with a consistent methodology to identify, analyze and manage risk
treatment efforts in one consolidated system.
Through the Risk Project application, an organization can:
Manage the process of performing risk assessments from scoping through to treatment
Use multiple scoping options to filter the multi-domain risk assessment
Support singular input (one participant) or multiple inputs (multiple participants) for risk
identification
Manage risk-related projects through a lifecycle of:
Project staffing and scoping
Risk assessment, aggregated scoring and multiple assessment support
Risk analysis and evaluation
Risk treatment, including remediation plans and exception requests.
Question Library
The Question Library application supports Archer eGRC solutions. As per the requirement ISO/IEC
27001:2013 standard will be uploaded in in the Question Library application in the archer. ADCO can
use these questions as often as you like in any type of assessment.
Through the Question Library application, Team can:
Import existing questions, use pre-loaded question packs from the Archer eGRC Content Library,
or enter questions manually through the application's web-based interface.
Assign questions to categories and apply filter properties that team can later use to create
question display rules.
Assign correct answers, numeric answer values and question weighting.
Link questions to authoritative sources and control standards in the Archer Policy Management
solution.
Link questions to statements of risk in the Archer Risk Management solution.
Risk Management Solution Design Document
Finding
The Findings application supports the Archer Risk and Compliance Management solutions. It is used to
document issues, deficiencies or gaps found through assessments and control testing. Findings are
auto-generated from questionnaires and include links back to the questionnaire, target and any
applicable control standards and authoritative sources. Findings may be resolved via remediation tasks
or exception requests.
Through the Findings application, Team can:
Review findings that are auto-generated through the results of assessments and control
testing.
Use automated workflow to route findings to appropriate personnel, and track tasks
associated with findings resolution.
Mitigate findings through remediation tasks or exception requests. The system calculates
residual risk and compliance status based on the resolution of findings.
Remediation Plans
The Remediation Plans application allows to centrally manage multiple findings and track actual and
estimated remediation costs and timeframes. Relating multiple findings in the context of remediation
plans allow to identify larger issues and support informed decision making. Through the Remediation
Plans application, Team can:
Review all findings, alerts and scan results related to a particular issue through one central
location.
Provide users with an actionable, repeatable plan to respond to issues found during an audit or
assessment.
Automate workflow for remediation tasks and review activities.
Exception Requests Form
Risk Management Solution Design Document
The Exception Requests application allows the team to manage the process of granting and expiring
exceptions to policies and control standards. Through built-in workflow, team can ensure that all
exceptions are properly reviewed, and report on exceptions across the enterprise, monitoring them by
control, department, or severity to visualize the impact of policy exceptions on the business and its
compliance posture.
Through the Exception Requests application, team can:
Enable employees to submit their own exception requests through an easy-to-use web interface.
Identify impacted control standards and compensating control procedures.
Evaluate exception requests and approve or deny them based on risk posed to the business.
Grant exceptions for a specific period of time, and notify proper personnel as expiration dates
approach.
Enable management to track granted exceptions, facilitating periodic reviews of exceptions and
their impact.
Quarterly Risk Review
The Quarterly Risk Review is a questionnaire that targets each Risk Register entry. The purpose of the
questionnaire is to prompt the risk owner to verify the documentation of the Risk Register entry. This
ensures that the documentation in the Risk Register stays current.
The Quarterly Risk Reviews can be scheduled as campaigns on a quarterly basis for risk owners to
validate the content in the Risk Register. The simple questionnaire captures the acknowledgement of
the risk owner that the information related to the risk is current.
Risk Management Solution Design Document
Below diagram shows the logical connections of applications in Risk Management Solution.
Figure 3: Exception Management Application Relations
Risk Management Solution Design Document
Risk Management & Solution level relations
Below diagram show the relationship of Risk Management applications with other Solutions of Archer
Figure 3: Risk Management – Relationship with other Solutions
Above figure shows that Risk Management is connected to other archer solutions like Policy
Management, Enterprise Management Compliance Management and Incident Management.
Enterprise Management: The Functions and Business process applications of Enterprise Management
Solution are connected to Loss events and Risk Register applications of Risk Management Solution.
The main objective of this connection is to map the Loss events and Risks to the impacted Functions
and Business processes. This helps management in understanding the key areas of Risk.
Policy Management: It is connected to the following applications of Risk Management:
1. Loss Events: To map the loss event with the impacted control Standards and Policies
2. Metrics: To map the support the Compliance Assessments(As the assessments are performed
with respective to the Control Procedures)
Risk Management Solution Design Document
Incident Management: Risk Register application is connected to the Incidents application of Incident
Management solution. This is to provide the mapping and reports on the Risks that are raised in the
system from the Security Incidents
Risk Management Solution Design Document
Risk Documentation/Review Stages
Risk Management Solution Design Document
Figure 5: Risk Management Process Flow
Field level Details of Applications
The attached file provides a detailed description regarding the configuration changes that will be made
to the Risk Management Solution.