⚠️ This is a paid add-on. Contact your account manager if you are interested.
When you use Tenacy for the first time, a tutorial will guide you through the creation of your first risk analysis.
Tenacy's risk analysis is based on traditional methodologies (EBIOS-RM, ISO 27005), simplifying them in terms of threats and taking advantage of elements that already exist in Tenacy, such as measures.
It incorporates the following basic elements:
Scales of business stakes that enable impacts to be qualified at business level
Business values that support the production of value for the company
Supporting assets that enable the production of business values
Threats to support assets, leading to potential impacts on the production of business values, qualified on the scale of the challenge
Counter measures to threats
💡 Before launching your risk analysis, we advise you to check the different scales of business stakes. So read this article to find out more.
Add a register
To launch a risk analysis, you need to create a risk register.
To do this, go to Risks > Analysis > Add register
🔎 Is this the first time you've used risk analysis, but you no longer have access to the tutorial?
You can reactivate it: click on your new register > click on the 3 dots > Enable tutorial
Add business value
Once you are on your register, you need to add business values. Click on Create business value
You can add a business value from a template (i.e. an object available in the Tenacy catalogue) or you can create your own business value by filling in the necessary fields:
Business value name
Risk analysis register (by default, the register in which you create the value appears)
Impact levels (Opportunity, Regulatory, Reputation, Revenue)
Please note that when you select a business value from a template, you need to fill in the different impact levels yourself, depending on your organization.
Add supporting assets
Once you have added your business values, click on one of them to add the supporting assets.
Tenacy will suggest supporting assets that have already been modelled in the solution.
🔎 If you want to create your own supporting assets, read this article.
In Catalog, you can therefore fork and link several supporting assets to your business value by clicking on this button:
Add threats to your supporting assets
By clicking on a supporting asset, you can add your threats.
By default, the supporting assets in the catalog have associated threats:
You can also add threats directly from the list on the left:
🔎 You can also create your own threats on Tenacy. Read this article to find out more.
Adding threats to your analysis automatically suggests measures as countermeasures:
Modify probabilities
Before synchronizing your risk analysis, you can modify the probabilities of your threats. These are the colored circles between your supporting assets and your threats:
Click on it to change the probability:
You can also adjust the impact and probability reduction on the measures:
Synchronize
When you feel your settings are correct, you can synchronize your analysis to create the corresponding risks.
🔎 Any settings in your analysis can be changed afterward.
To do this, simply return to the list of registers and click on Synchronize :
You will need to choose a risk register, and you can select which (initial) risk levels you want to synchronize. By default, all levels are selected:
Synchronization will have the effect of :
Create risks that did not yet exist
Update existing risks
Close existing risks that are no longer generated by the analysis.
List of your risks
To find the risks created by the analysis, go back to the Treatment tab and find the name of your register in the list.
You now have access to the risks created by your analysis.
Each risk includes the list of measures proposed during the analysis. If any of these measures are already implemented or in process of implementation on your security base, you will see them appear in your risk treatment plan.
If, on the other hand, the measures have not yet been implemented in Tenacy, you will see them in the Suggestions tab so that you can add them to your treatment plan.
💡To learn about the treatment of your risks, read this article.