Security measures
Polyodos distinguishes two kinds of measures based on their purpose and when they apply in the analysis cycle.
Preventive protection measures (PP)
PP measures reduce the likelihood of a risk scenario occurring. They apply at the level of supporting assets (Workshop 1) or operational scenarios (Workshop 4).
Examples:
- Multi-factor authentication (MFA)
- Encryption of data at rest and in transit
- Network segmentation and demilitarised zones (DMZ)
- Patch management
- User training and awareness
- Physical access control to sensitive premises
Add a PP measure
- From the Supporting assets page (Workshop 1) or Operational scenarios page (Workshop 4), click ＋ Add a measure
- Select or import from the PP measures library
- Fill in the fields:
| Field | Description |
|---|---|
| Label | Short name of the measure |
| Description | Technical or organisational detail |
| Type | Technical / Organisational / Physical / Legal |
| Status | Planned / Being deployed / Implemented / Obsolete |
| Normative reference | ISO 27001, NIS2, NIST CSF, CIS Controls… |
| Effectiveness | Likelihood reduction provided (estimate) |
| Owner | Entity or person in charge |
Risk treatment measures
Treatment measures come in after unacceptable risks have been identified (Workshop 5). They define how each risk is reduced, transferred, refused, or accepted.
Examples:
- Business continuity / disaster recovery plan (BCP / DRP)
- Externalised and tested backups
- Incident response (IR) procedures
- Cyber insurance
- Replacement of an obsolete system
Add a treatment measure
- In Workshop 5, click ＋ Add a measure
- Fill in:
| Field | Description |
|---|---|
| Risk treated | Operational scenario concerned |
| Treatment type | Reduction / Transfer / Refusal / Acceptance |
| Label | Name of the measure |
| Description | How the measure reduces the risk |
| Owner | Entity responsible for implementation |
| Deadline | Target implementation date |
| Estimated cost | Optional (planned budget) |
| Status | Planned / In progress / Implemented |
| Expected effectiveness | New estimated residual likelihood |
Measure tracking
The Measure tracking page (available from the menu) consolidates all measures across the whole project (PP + treatment) in a single dashboard:
- Filter by status (Planned / In progress / Implemented)
- Filter by owner
- Filter by type
- Indicators: overall progress rate, number of overdue measures
Measure library
The PP measures library and the Treatment measures library contain standard measures aligned with the main frameworks (ISO 27001 Annex A, NIS2, NIST CSF, CIS Controls v8, IEC 62443 FR).
To import from the library: 📚 Library button in the measures panel of any analysis page.
To save a custom measure to the library: measure detail sheet → Save to library.
Measures in Industrial Risk analyses
In the RI module, measures are managed directly in each analysis table:
| Analysis | Existing measures column | Planned measures column |
|---|---|---|
| PHA | Existing measures | Planned measures (optional) |
| PHA — Hazard study | Passive MMR / Active MMR | — |
| FMEA | Corrective measures | — |
| HAZOP | Existing measures | Measures to consider (optional) |
| LOPA | Existing IPL | IPL to add |
The 🛡️ Measures tab of each RI analysis page consolidates the planned measures from all analysis rows, with status and owner tracking.