Risk. Compliance.
Audit Readiness.
Finally Connected.

Incident reporting decisions are sealed in your tamper-evident record; risk decisions keep reasons. Board and committee meetings and decisions, each with a reason and links to risks, findings and policies; a final meeting cannot be changed. No one is notified.

From Compliance Workspace

Each control can name who is Accountable, Responsible, Consulted and Informed, as roles you create, each optionally linked to a member. Every assignment change is logged and the matrix downloads as CSV. No one is notified.

From Compliance Workspace

A register of your policies with an owner, a version history, the approval of each version by your organisation, and review dates; a version can link to its document in the evidence vault. Vivid Risk does not write or enforce policies, and no one is notified.

From Compliance Workspace

The scope check asks the questions that bear on which laws apply and reads your answers; it does not decide your legal status. Every scored control names the requirement it is cited against.

From Assessment

Every open gap, ranked, with a suggested action, an owner you can assign and a log of the work done on it.

From Assessment

Changes you record: the law or guidance you name, your summary, effective date, impact, owner and assessment, linked to controls, policies and risks, as CSV and PDF. Vivid Risk fetches no source and says nothing about what the laws you record require.

From Compliance Workspace

The questionnaire is your control set, scoped to your jurisdiction. From Compliance Workspace, registers for your security tests, tools, log sources and certifications sit beside it.

From Assessment

Each control can have an Accountable role, with Responsible, Consulted and Informed roles beside it, linked to a member if you choose, with a change log and a CSV. The owner of a gap's fix is recorded separately. No one is notified.

From Compliance Workspace

Each control is cited to the frameworks it falls under, with each citation marked as checked against its primary text or not.

From Assessment

Each risk has a category, a likelihood and impact rating and a next review date, and can have an owner, a treatment and a residual rating you enter. Accepting or closing one records who decided, why, and whether it was above your risk appetite.

From Compliance Workspace

A 5×5 likelihood and impact grid of your open and accepted risks, inherent or residual. The residual rating is the one a person enters; Vivid Risk computes none.

From Compliance Workspace

The Financial Loss Estimator runs a Monte Carlo simulation over your own estimates of how often a loss happens and what it costs.

From Compliance Workspace

Findings from an auditor, a test, a regulator or a review, recorded with the controls they concern, their severity and their corrective actions. Closing one records how the fix was checked. Vivid Risk runs no test.

From Compliance Workspace

Tests of design and operating effectiveness you record per control, with method, sample and result; from a test that is not or only partly effective you can record a finding. Vivid Risk runs no test.

From Compliance Workspace

Evidence attached to each control, showing which side uploaded it, how fresh it is, and whether your partner's reviewer accepted it or you self-declared it.

From Assessment

An asset register with each asset's criticality and the essential services it supports, recorded by you; it discovers nothing.

From Compliance Workspace

Cyber risks sit in the risk register under their own category, rated by likelihood and impact with a treatment. Beside it, a register of significant cyber threats and the duties each one triggers; it notifies nobody.

From Compliance Workspace

The software each asset runs with its end-of-support date; vulnerabilities tracked from CVSS triage to resolved, with a deadline; and a patch register of patches planned, applied, failed or rolled back, where, when and by whom. It applies and scans nothing.

From Compliance Workspace

Corrective actions with owners, due dates and recorded verification, for findings from an audit, a test, a regulator, a review or an incident (which lists them). A control gap has its own owner and work log. A personal-data breach records its remedial action.

From Compliance Workspace

Problems and concerns you log, with priority, owner, due date and resolution, linked to risks, controls and a finding; the log as CSV, each issue as PDF. An issue becomes a finding only when you record one from it. Vivid Risk notifies no one and sends nothing.

From Compliance Workspace

Sets out the NIS2 significance and DORA major-incident criteria for you to answer, records your answer and reasons, and runs each reporting clock that applies. It files nothing.

From Compliance Workspace

A supplier register with criticality and data access (up to 35 suppliers on Compliance Workspace), DORA Register of Information preparation if DORA applies, and an AI briefing on supplier concentration.

From Compliance Workspace

Supplier questionnaires you export and send yourself, each built-in question showing the clause it was drawn from, with the answers, outcome and next review date you record; and, if DORA applies, the Article 30 contract checklist. It sends nothing.

From Compliance Workspace

Your Article 30 record of processing, as controller or processor, each heading citing its point, linked to your suppliers and assets, exported as CSV or PDF. It decides nothing about lawfulness and sends nothing.

From Compliance Workspace

Privacy risks sit in the risk register under Data protection. Beside it, a DPIA register: screening and Article 35(7) assessments covering one or more processing records, linked to risks, each heading citing its point. Vivid Risk decides and sends nothing.

From Compliance Workspace

Your Vivid Maturity Index places you on a maturity ladder, overall and by domain.

From Assessment

Every gap is ranked into a roadmap. From Compliance Workspace, a spend optimizer picks the fixes worth most within the budget you set.

From Assessment

Key risk indicators and readings you type in yourself, each banded Green, Amber or Red against thresholds you set, linked to risks in the risk register, and exported as CSV and PDF. Vivid Risk collects no figures and changes no risk.

From Compliance Workspace

Executive views of your score and how it moves as findings are resolved, and a board report PDF. From Compliance Workspace, the same page shows the risks, issues, findings, tests, policies, KRIs, regulatory changes and board and committee decisions you record.

From Assessment

One dashboard with your score and your top priorities.

From Assessment