Two purpose-built platforms — one for ISO/SOC 2/TISAX, one for CMMC/NIST/HIPAA — sharing a common risk engine, asset inventory, BIA module, and evidence management system.
RiskABC handles ISO and commercial standards. RiskABC Gov handles US government and regulated industry compliance. Both share the same risk engine and scoring model.
Manage controls across ISO 27001, ISO 9001, ISO 22301, ISO 27701, ISO 42001, ISO 20000-1, TISAX VDA ISA 6.0, and SOC 2 — simultaneously. Switch frameworks in the sidebar; data, risks, and evidence remain consistent.
Designed for Defense Industrial Base contractors, federal suppliers, and healthcare organizations. Every required practice and control is ready to work with the moment you log in — no setup needed. POA&M tracking built in.
Every framework ships pre-seeded with all controls on first login. No setup. No imports.
Every risk in every framework uses the same CIA-weighted formula. Inherent and residual scores. Org-configurable level labels and acceptable risk threshold.
When a risk is linked to an asset, Confidentiality, Integrity, and Availability values carry over automatically from the asset's ratings — locked and labelled "from asset". Standalone risks prompt the user to set CIA manually.
Set an org-wide threshold (≤8, ≤16, ≤25, or none). Any risk scoring above it triggers an amber warning badge and banner. Accepting a high-score risk requires a written justification before saving.
Twelve integrated modules — from controls to BIA to corrective actions — all framework-aware and org-scoped.
Select multiple Assets, Risks, Threats, or BIA processes and delete them in one move. BIA bulk-delete cascades cleanly — auto-generated risks and their open tasks disappear with the parent process. Restricted to Org Admin and Privileged Consultant.
Run both ISO and Gov programs? Asset inventory built in RiskABC can be imported read-only into RiskABC Gov — no double-entry. Bidirectional opt-in: both sides must agree to the share. Imported assets carry a source badge so it's always clear where they came from.
Document every critical business process, rate its impact across five categories, plan recovery, and auto-generate risks where gaps exist.
All tier names are fully customizable in Org Settings.
When a BIA process is saved, the system automatically creates a Risk Register entry if:
Risk impact level is derived from the BIA max impact. Name prefixed with [BIA].
All 110 practices are ready to work with the moment you log in. Full approval workflow, risk scoring, and POA&M enforcement included.
Centralized evidence library with type color-coding, file hashing, validation metadata, and per-control evidence counts visible in every controls table.
Classification labels, risk level names, acceptable thresholds, BIA tier names — all configurable per organization with live updates across every module.
Stored DB values unchanged — only display names change.
Score thresholds are fixed — only the label names change.
Custom names shown in BIA table, badges, and summary cards.
Same risk engine, different compliance programs. Choose the platform that matches your regulatory obligations — or use both.
| Feature | RiskABC (ISO / SOC 2) | RiskABC Gov (CMMC / NIST) |
|---|---|---|
| Dashboard with domain charts | ✓ | ✓ |
| Controls management | ✓ 8 frameworks | ✓ 3 frameworks |
| Statement of Applicability (SOA) | ✓ (ISO 27001, 27701, 42001, TISAX, SOC 2) | — |
| Risk Register (Asset × Threat) | ✓ Mitigate / Accept / Transfer / Avoid | ✓ Mitigate / Accept / Transfer |
| CIA scoring in risk formula | ✓ All frameworks | ✓ |
| Standalone risks (no asset) | ✓ | ✓ |
| Risk threshold + justification | ✓ | ✓ POA&M required |
| Asset Inventory (7 types, CIA) | ✓ | ✓ |
| Threat Library | ✓ | ✓ |
| Policy management (15 types) | ✓ | ✓ |
| Evidence Library (6 types + SHA-256) | ✓ | ✓ |
| Business Impact Analysis (BIA) | ✓ Tier 0–3 | ✓ Tier 1–4 |
| BIA → Risk auto-generation | ✓ | — |
| Immutable Audit Trail | ✓ | ✓ |
| Reports & CSV export | ✓ SOA + Risk + Summary | ✓ Risk + Assessment |
| Risk Manager role | ✓ | — |
| Evidence Owner role | — | ✓ |
| Custom classification labels | ✓ | ✓ |
| Custom risk level labels | ✓ | ✓ |
| Custom BIA tier labels | ✓ Tier 0–3 | ✓ Tier 1–4 |
| Multi-tenant (org-isolated data) | ✓ | ✓ |
| SSO + MFA | ✓ | ✓ |
Schedule a live demo and we'll walk you through both platforms with your specific compliance requirements in mind.