devguard

Assessment matrix

Read the register as a heat map, see how far treatment has moved it, and find the risks above your accepted levels.

The assessment matrix draws the register on your risk criteria. One axis is probability, the other is impact. Each cell has the level that your settings give it. The settings decide the size of the grid, the level names and colors, and the level of each cell. The same grid rates vendors.

The 5 × 5 heat map in the residual reading, with the Moderate × Possible cell selected and the inspector listing its risks.
Residual heat map on the default 5 × 5 criteria. The selected cell holds 29 risks at Medium.

The inspector on the right shows the cell, its level, its required response, and the risks in it.

Read the heat map

  1. Open Risks → Assessment Matrix. The Heat map tab opens first.
  2. Choose Initial (before treatment), Residual (after treatment), or Both. Both shows the residual count with the initial count beside it. Each cell shows how many risks it holds, its level, and one mark per risk.
  3. Select a cell. The inspector lists its risks with their treatment strategy and the response that the cell's level requires. Open register view opens the register filtered to that cell.

The strip below the grid shows the distribution after treatment. An arrow per level shows the change against the initial ratings. The strip also shows the treatment actions: how many are open, planned, in progress, and implemented.

See what treatment has changed

The Drift tab shows the initial and the residual exposure as two small grids side by side. Each grid shows how many risks are at a level that is not acceptable.

The Drift tab: the initial and residual 5 × 5 grids side by side, and the biggest movers below.
12 risks start at a level that is not acceptable. After treatment, one remains.

Below the grids, Biggest movers lists the risks whose level changed most. Each row shows the level before and after, and the treatment type. Use this tab to show what your actions achieved.

Find the outliers

The Plot tab shows every risk as a point on the probability and impact axes. A light tint shows the level of each cell. Risks with the same position merge into a bubble; its size shows how many. Hover over a bubble to see its risks.

Filter to Untreated risks or to those Owned by me. The side panels count the risks at a level that is not acceptable and list the five largest exposures.

Opportunities

The Kind select above the views switches from risks to opportunities. Opportunities have their own Opportunity matrix on a blue scale. There, a high rating means an attractive opportunity, not a dangerous one. Opportunities never appear in the risk views.

Reference

ReadingShowsUse it to
Heat mapCount, level, and marks per cell; inspector per cell; distribution and actions belowFind the cells that matter and open their risks
DriftInitial and residual grids; biggest moversShow what treatment has changed
PlotOne point per risk, bubbles for shared positions; untreated and owned-by-me filters; top five exposuresFind the outliers and your own risks

There is no matrix endpoint. To draw the matrix yourself, read GET /risks/ and GET /risks/criteria/. The level of a point is criteria.matrix[impact - 1][likelihood - 1], an index into criteria.levels.

How is this guide?

On this page