Risk management system
Anrix: one risk register, any framework
Demonstrable risk management under the standard or regulation that applies to you — ISO/IEC 27001, a national NIS2 transposition, DORA, Article 32 of the GDPR, TISAX or your own internal framework. On your own infrastructure, for all your entities.
Who it is for
- Groups with several entities that want one risk register and one head-office view instead of a spreadsheet from each entity.
- Regulated entities that have to evidence risk management to a regulator or an auditor — with the date, the owner and the approval on record.
- Public bodies with subordinate organisations — one installation, each organisation with its own register and owners.
- Organisations that have to keep analysis data on their own infrastructure — the data never leave their environment.
What you get
- A register of assets, threats, vulnerabilities, risks and measures, with links between assets, risks and measures; every asset has an owner
- Configurable likelihood × impact scoring with an acceptance threshold set by your methodology
- A recorded approval of residual-risk acceptance — who accepted it and when
- An action plan with deadlines, owners and status
- An immutable change history for every record
- Periodic review with the date and the result recorded
- A risk report for management and for the auditor
Methodology and outputs
Risk assessment follows ISO/IEC 27005. The threat and measure catalogues are supplied with the system and can be mapped to the requirements that apply to you — the controls of Annex A of ISO/IEC 27001, a national transposition of NIS2, the TISAX catalogue or your own internal framework. Mapping to a further set of requirements is added on request, like any other catalogue.
Outputs: a risk list with ratings, proposed measures, a residual-risk acceptance proposal, and a risk report for management and the auditor.
For financial entities under Regulation (EU) 2022/2554 (DORA), the analysis serves as the basis of the ICT risk management framework (Article 6) and of the identification and classification of assets and risks (Article 8) — see Digital operational resilience (DORA).
Several entities, one view
Each entity has its own register, owners and approvals, with data kept separate. Head office sees them all on the same scale — where risks repeat and where measures are late.
One analysis, several languages
The interface and the analysis content run in the languages you work in — one analysis, without separate copies. A local administrator works in their own language; head office reads in its own.
How it is delivered
Anrix is installed on your infrastructure as Linux containers and accessed through a browser, with nothing installed on end devices. Updates, fixes and support run under an agreed service level, and the data stay with you.
The licence is annual and priced by the number of entities in the installation. Pricing and multi-year terms on request.
For public contracting authorities
A functional specification of the subject matter of the contract — manufacturer-neutral, with CPV codes — is available on request.
Limits
- The system does not make risk decisions. It records them: acceptance of residual risk is approved by an authorised person.
- Where we help prepare the analysis in Anrix, the audit is done by a different team.
Demo and trial access
We will show you Anrix remotely on your own examples, or set up trial access for 14 days from first login.
Tell us how many entities you want to manage — we will arrange a demo or trial access.
Tell us what you are dealing with.
Thirty minutes with a consultant who knows your industry. The output is a one-page summary with a recommended approach and an indicative scope — we send it to you even if we do not reach an agreement.