A risk register nobody can paste over.
Zikomo turns an ISO 27001 Annex A control gap assessment into a scored, owned, board-ready risk register. Built by GUUT Technologies for banks, microfinance and payment providers across Africa.
ISO 31000:2018 · ISO/IEC 27005:2022 · ISO/IEC 27001:2022 Annex A
Every score computed server-side. Every change in an append-only trail.
40 risks · 33 columns
Seventeen rows said Priority 1. The file could not prove it.
33 columns, maintained by hand
We reviewed a completed enterprise risk assessment from a commercial bank. Forty risks, thirty-three columns. In seventeen of the forty rows a calculated field had been overwritten by a paste, so the priority could not be verified from the file. Every one of them still displayed as Priority 1.
Twenty-seven of the forty were marked Accept with no budget allocated. The spreadsheet had no column that could say so.
Nobody was careless. That is what happens when the document governing a bank's security posture is a file, edited by hand and emailed between departments. Zikomo computes every derived field on the server, refuses to accept one from a form, and writes every change to a trail that has no update path and no delete path.
Row positions are illustrative. The counts are from the file.
Five stages, in order
Five stages, in the order the standard writes them.
Clause 6.1.3 is a signature, not a formality. ISO 27001 requires the risk owner to approve the treatment plan and formally accept residual risk. A consultant cannot do this on a client's behalf, so Zikomo stores every score twice: the pair the consultant proposed and the pair the owner confirmed. The register resolves to the confirmed pair and nothing else.
else does
The questionnaire writes the register.
Everywhere else, a gap assessment and a risk assessment are two exercises, joined afterwards by a consultant, a spreadsheet and a long afternoon. Here they are one motion.
Are networks, systems and applications monitored for anomalous behaviour, with action taken to evaluate potential incidents?
Attackers can hide their activity on compromised systems because monitoring is manual and reactive.
| Generated from | A.8.16 · new in 2022 |
| Threat phrasing | Automatic |
| Proposed likelihood · impact | 4 · 5 |
| Proposed priority | P1 |
| In the live register | Not yet |
Answer Non-compliant and a threat-phrased risk drops into the queue, pre-scored and tied to the control. Answer Compliant and nothing happens. Nothing reaches the live register until a consultant promotes it. The automation drafts. A person still decides.
114 controls to 93
Eleven lines your last assessment never contained.
ISO 27001:2013 had 114 controls in 14 domains. The 2022 edition has 93 in 4 themes, and eleven of them have no 2013 ancestor. A gap assessment written against the old set never asked about threat intelligence, cloud services, data masking or secure coding, because those questions did not exist when it was written.
Choose either edition at onboarding, with the reason recorded. Run the crosswalk and see, control by control, what a legacy assessment left untouched.
The 2013 to 2022 transition deadline has passed. Certificates issued against the 2013 edition are no longer valid.
| Ref | Control | Theme | 2013 equivalent |
|---|---|---|---|
| A.5.7 | Threat intelligence | Organizational | None |
| A.5.23 | Information security for use of cloud services | Organizational | None |
| A.5.30 | ICT readiness for business continuity | Organizational | None |
| A.7.4 | Physical security monitoring | Physical | None |
| A.8.9 | Configuration management | Technological | None |
| A.8.10 | Information deletion | Technological | None |
| A.8.11 | Data masking | Technological | None |
| A.8.12 | Data leakage prevention | Technological | None |
| A.8.16 | Monitoring activities | Technological | None |
| A.8.23 | Web filtering | Technological | None |
| A.8.28 | Secure coding | Technological | None |
calendar, per institution
Kwacha is not a rounding error.
Your currency, unconverted
Asset value bands are configured per institution, in that institution's own currency. A bank valuing in kwacha and a bank valuing in naira need entirely different scales, and neither is converted for display. Annualised loss expectancy is reported in the money the board actually spends.
Your regulator's calendar, not a hard-coded one
Reporting obligations are rows, not code. Each one is configured for the institution that owes it.
current register
See it against your own assessment.
Bring the register you have today. We import it, recompute every derived field, and tell you plainly which rows the file can prove and which it cannot.