1. Your personal GRC dashboard

When you log in, you immediately see what requires your attention: risks to assess, treatments to follow up, controls to evaluate, and approvals to review.

Each team member gets a focused view of their responsibilities. Managers get a bird's-eye view of all ongoing activities for oversight and approval.

2. Map your assets

Before managing risks, you need to know what you are protecting. Register your critical assets — IT systems, databases, departments, suppliers, processes — in a structured inventory.

• Parent/child hierarchy reflecting your organizational structure
• Import departments from Odoo HR directly as assets
• Link assets to projects for project-based risk management
• Supplier tracking with criticality levels for supply chain risk
• Compliance rate per asset showing protection coverage

3. Visualize your risk landscape

The interactive 5x5 risk matrix gives you an instant visual overview of where your organization stands. Click any cell to drill down into specific assessments.

Configure your risk appetite threshold — the module automatically flags risks that exceed your tolerance, so you focus attention where it matters most.

4. Assess your risks with a proven workflow

Each risk goes through a structured assessment lifecycle:

• Inherent risk — risk level before any controls
• Residual risk — risk level after existing controls
• Target risk — where you want to be after treatment

Impact and probability are scored on a 5-point scale. The module calculates risk levels automatically and determines whether each risk is within or outside your appetite. Approval workflows ensure assessments are validated by the right people.

5. Standardize with risk templates

Build a library of risk templates representing common risks in your industry or organization. Assign templates to assets and the module automatically creates the corresponding risks.

When you update a template, all linked risks stay in sync — ensuring consistency and saving hours of repetitive work.

6. Treat risks with clear action plans

For every risk outside your appetite, define a treatment strategy:

• Mitigate — implement new controls to reduce the risk
• Transfer — shift the risk to a third party (insurance, outsourcing)
• Avoid — eliminate the activity causing the risk
• Accept — acknowledge and monitor the risk as-is

Each treatment has an owner, a deadline, and tracked progress. Mitigations link directly to risk assessments for full traceability.

7. Manage and evaluate your controls

Build a comprehensive control library and continuously evaluate effectiveness:

• Design effectiveness — is the control properly designed to address the risk?
• Operating effectiveness — is the control actually working in practice?
• Control testing — run test procedures with PASS/FAIL results and evidence

Controls are linked to assets, regulatory requirements, and risk assessments for complete traceability from regulation to implementation.

8. Deploy controls faster with templates

Build a reusable library of control templates aligned with your frameworks. Each template defines design criteria, testing procedures, and authorization levels.

Deploy a template on an asset and the module creates the control with all predefined settings — ensuring a consistent security baseline across your entire organization.

9. Stay compliant with regulations

Import and manage the regulations and standards that apply to your organization. Break them down into individual requirements and map each requirement to controls.

The module tracks your compliance rate per regulation in real time — you always know exactly where you stand and where the gaps are.

DORA NIS2 GDPR ISO 27001 ISO 9001 CYFUN Custom

10. Document your policies

Create and maintain your security and governance policies directly inside Odoo. Track versions, manage approval workflows, and ensure everyone has access to the latest approved version.

Policies are the foundation of your governance framework — the module makes sure they're actively managed and up to date, not written once and forgotten.

11. Track and learn from incidents

When something goes wrong, you need a structured response. Log security incidents, perform root cause analysis, assess impact, and define corrective actions.

Incidents are linked to affected assets, providing a complete incident history that helps identify patterns and strengthen your defenses over time.