SimpleRisk is an open-source risk management system released under mozilla-public-license and used for risk-management activities.1) It enables risk managers to account for risks, plan mitigation measures, facilitate management reviews, prioritize for project planning, and track periodic reviews. SimpleRisk allows risk managers to prioritize enterprise responses according to the severity of threats and vulnerabilities that could impact the business.2)
SimpleRisk sports a dashboard for submitting a new risk for consideration by your team, for creating risk reports and graphs of risk levels and locations.3) Highly configurable, SimpleRisk report generation is dynamic; risk formulas could be tweaked on the fly.4)
SimpleRisk was borne out of the need to have an inexpensive system to deal with enterprise risks, including application and physical threats and vulnerabilities, malwares. To manage risks, the choice of tools for risk managers has almost always been between expensive GRC (governance-risk-management-and-compliance) software and cumbersome, time consuming spreadsheets.5) Using a LAMP (Linux, Apache, MySQL, PHP) stack, Josh Sokol developed SimpleRisk based on some simplifications of the NIST 800-30 risk management framework.6)
Hackers Mail lists SimpleRisk as one of “the best open source risk assessment tools.”7)
* Robert Sorensen, “ SimpleRisk: Enterprise Risk Management Simplified,” The SANS Institute, 2014.