Riskonami

The P1–P9 walk on the live product — what you do, what the server does, and where optional AI fits.

This is the operating manual for phased assessment at New assessment. Once-through, recorded interview, and voice are not offered yet; the method is the same engine when they ship. You can complete every step without AI.

Before you start

On New assessment you set:

Depth — complete (evaluate applicable items), light (priority subset; nothing silent-dropped), or caps you type
Objective, audience, expected output — these later shape the report introduction
AI on or off — the Allow AI enrichment checkbox on this page. Off = free process. On = named calls may run when their conditions are met (you do not get a Yes/Skip before every call)

Then you get a two-column workspace: data (tables, diagram) and chat (server questions).

New assessment

Start here after sign-in. Existing runs appear on the same page so you can resume or delete.

The nine phases

The labels below match the product. This is not the old ten-phase IRAM walkthrough (likelihood / inherent / residual / Phase 10 studio as separate public phases).

Riskonami v2 assessment spine: phases P1 through P9, optional named AI calls in red, server work in gray — Blue is your work. Red is a named AI call (1 token if it runs). Yellow is a Yes/No or button. Gray is server work and is not billed. There is no Phase 10.

Phase	What you establish	Your work
P1 Context and impact	Who you are, the system, CIA, risk appetite, applicability	Answer questions. Optionally upload documents. Optional Call A
P2 Architecture and scope	Zones, components, flows, in-scope vs supplier	Build or confirm the model. Name the vendor on third-party / shared nodes. Optional diagram (Call B)
P3 Control allocation	Control points and weaknesses on the graph	Review Who. Where Who is supplier or shared, pick or add a named vendor. Confirm will not advance unnamed in-picture parties
P4 Threats	Threat scenarios on those weaknesses	Review the threat set and the Why
P5 Control strength	How measures are actually implemented	Tick / describe implementation. Optional Call C proposals
P6 Risk scores	Residual from IRAM tables	Read-only scores. Missing evidence stays UNKNOWN
P7 Decisions	Accept, mitigate, or transfer	You decide. The product never auto-accepts formal risk
P8 Treatment	Tasks and target state for what you mitigate	Review the plan (skipped when you accepted at P7)
P9 Report	Issued snapshot	Configure views, optional narrative (Call D), download

Architecture canvas

Phase 2 is a canvas. Name the responsible party on third-party and shared nodes before you confirm.

Phase 2 canvas: a Public zone with Browser, a GCP zone with Server, Bucket, and SQL, and labelled flows between them. — Draw zones, apps, and flows. Right-click to add or connect. Drag to move.

Phase progress

Progress comes from the saved phase pointer, not from a chat that “looks done.”

Assessment progress with P1 through P5 completed and P6 risk scores current. Later phases are still ahead. — Completed and current come from the saved phase pointer, not from a chat that looks finished.

Documents you upload

Uploads belong to that assessment, not a shared library.

Text (PDF, Word, notes) can feed Call A (and later C).
Pictures / diagrams can feed Call B after a “is this architecture?” gate.
The product does not spider the internet. One website URL you type may be fetched once.

You confirm extracted facts. Your corrections beat the model.

Evidence upload

Text feeds Call A. Pictures become diagram candidates for Call B in Phase 2.

File pack in Phase 1: a Word description and an extracted diagram candidate, Continue with these files still available. — Add files until the pack is complete, then Continue. The phase does not jump on each upload.

Vendors

Third-party work stays on this assessment. You name the vendor; you do not invent their implementation.

P2/P3: trading name (Amazon Web Services, Okta) — not “the cloud” from a zone type.
P5: supplier-owned rows stay visible but locked.
P7: those risks typically transfer.
P9: email a signed questionnaire, curate answers, download one file per named vendor.

Full walk: Vendors — name, questionnaire, downloads.

Confirming work

Each phase: read the prompt → fill or review the table → Continue / Confirm when the server says the phase can commit. You do not invent the next phase. If a row is UNKNOWN, leave it UNKNOWN. Do not “smooth” it to implemented.

Decisions stay yours

Phase 7 lists the risks. You choose accept, mitigate, or transfer. Confirm does not accept risk on your behalf.

Phase 7 decisions: each component lists its risk bands. The transcript says choosing Accept is your decision and the product will not accept a risk for you. — Each row already has a recommendation. Change it only when you disagree, then Confirm.

Reports

When you reach P9, issue and download reports. The issued file is a snapshot of committed work. Next: Vendors · Issue and download reports · Your assessments and data

Run an assessment