Disable/enable a risk information from the knowledge base

[mly-h]

Hi all,
I would like to disable risks that are not applicable to my analysis directly from the knowledge base without having to delete them permanently. However when I disable a risk with the status, it still remains visible in the risk analysis. I therefore find myself with a certain number of risks not to be considered.
It would be interesting to be able to disable threat, vulnerability or risks linked to the information of the risk analysis because, for example, the vulnerability no longer exists, or the threat is not applicable to the context (and reactivate risks because a it is now applicable). If, for example, a vulnerability or threat is disabled, the associated risk would be automatically disabled.
This will allow to reduce the number of the risk depending on the context of the analysis

[ruslanbaidan]

Hello,

The functionality you would like to see in Monarc could be a good addition to the tool, it was planned to be implemented initially, but due to some challenges and not much demand, abandoned.

The main things to be considered here are the following:

• if we disable a risk and then asset that has it instantiated to the analysis. After reactivation of the risk we have to validate all the assets and link it to them, apply the impact values that are possibly inherited, recalculate risk values and vice versa. Also in case of disabling remove the linked recommendations.
• the similar challenges are with activation/deactivation of assets and vulnerabilities in case if they are linked already to the analysis.

We can consider to develop this functionality in the future, but for the moment there are some possibilities that can be useful to achieve similar results:

1. Export all the informational risks to a .csv file, remove those risks that are not needed. When there is need in some risks, it's possible to import the whole exported .csv file or modify it and keep only the necessary ones. (When tested it , found and opened an issue with missing controls after import).
2. Each risk that is considered as not applicable could be marked as N/A in the "Existing controls" field. This way it's is visible. When it's still not applicable after a few iterations, it can be removed.