IT & CYBER RISK MANAGEMENT
Risk register · 5×5 assessment · action tracking
The demo is real output captured from the running app — not screenshots. Navigation works; saving and filtering do not.
WHAT IT IS
RiskOps was written to record an organisation's IT and cyber security risks, score them by likelihood × impact, track mitigating actions and produce documents that can be handed to management.
Automatic risk codes, 5×5 matrix, soft delete. The score is a generated column — the application never computes it, so it cannot drift.
Mitigating actions linked to a risk, with an owner and a due date. Overdue actions are flagged on the dashboard and in reports.
Six built-in reports and a one-page Executive Summary: letterhead, confidentiality notice and a signature block, ready to print.
SCOPE
This distinction is the most important design decision, so it is stated up front.
| Not this | Why it matters |
|---|---|
| Helpdesk / ticketing | There is no “request to close” here — there is an ongoing risk state. |
| ITSM tool | Asset inventory, change management and SLA tracking are out of scope. |
| Vulnerability scanner | It does not scan; it is where scan results are managed. |
| SIEM | It does not collect logs or correlate events. |
SCREENS
Each image opens that screen in the demo. The demo is HTML captured from a running installation: same CSS, same data, same layout.
QUALITY
These numbers come from tools in the repository and are re-measured by CI on every push.
password_hash(), CSRF on every POSTunsafe-inline in CSP — no inline scriptsWhy there is no framework, why the translation key is the Turkish source string, why no sandbox is claimed for plugins — each with its reasoning in the ADRs.
INSTALL
git clone https://github.com/CodeByPinar/riskops.git
cd riskops && docker compose up
Then open localhost:8080. Demo data
is optional and loads with a single command.
Ubuntu 24.04 · PHP 8.3 · MariaDB 10.11 · Apache 2.4. The schema is a single file and can be loaded twice (idempotent). Steps are in the README.