risk_heatmap View

The risk_heatmap view projects architectural risk scenarios onto an operational Likelihood × Impact matrix, allowing teams to track inherent risk against residual risk after treatment.

---

Visual Projection

Risk Heatmap View comparing inherent vs. residual risk scenarios across a Likelihood × Impact matrix

---

Purpose & Target Audience

• Target Audience: Chief Risk Officers (CRO), Enterprise Risk Committees, IT Governance Teams, CISO.
• Primary Use Cases:
  • Visualizing the enterprise risk posture across operational, cyber, and cloud dimensions.
  • Demonstrating the efficacy of security controls in reducing inherent risk to acceptable residual levels.
  • Tracking risk treatment strategies (Mitigate, Accept, Transfer, Avoid).
  • Prioritizing remediation budgets for high-impact residual risks.

---

Supported Entity Types

Entity Type	Role in Risk Heatmap	Description
risk_scenario	Primary Metric Element	Comprehensive risk scenarios with likelihood, impact, and treatment.
threat	Threat Event	The specific adversary or operational event triggering the scenario.
control	Risk Treatment	Safeguards that reduce likelihood or impact.
system, app	Impacted Asset	Enterprise systems vulnerable to the risk scenario.

---

Supported Relationships & Verbs

Relationship Verb	Source Entity	Target Entity	Typical Representation
targets	risk_scenario, threat	system, app, infra	Exposure edge
mitigates	control	risk_scenario, threat	Control mitigation edge
governed_by	risk_scenario	policy, standard	Policy governance edge

---

Filtering & Layout Recommendations

• Recommended Layout: Grid / Matrix projection.
• Common Predicates:
  • include risk_scenario where residual_rating == "Critical" || residual_rating == "High": Unacceptable risk exposure.
  • include risk_scenario where treatment == "Accept": Accepted risk register.

---

Complete DSL Example

views {
    risk_heatmap v_enterprise_risk_posture "Enterprise Operational Risk Heatmap" {
        # Select all risk scenarios and mitigating controls
        include risk_scenario
        include control
        include threat

        # Link controls to risks
        include_verb mitigates
        include_verb targets

        # Style high residual risk items prominently
        style risk_scenario where residual_rating == "Critical" {
            css_class "risk-critical-badge"
        }
    }
}