Integrated Risk & Issue System (IRIS) - Enterprise Risk Management Software v6.7.1
IRIS Enterprise Risk Management Software helps organisations assess enterprise-wide risks and manage them more effectively. It facilitates increased risk identification, ensures assessment consistency, tracks mitigation action progress and delivers timely, customised reports to Management. IRIS-ERM is a highly flexible system with tailored customer processes, and ISO31000, ISO27001 and PMBoK support.
Features
- Enterprise Risk Management System
- Fully Hosted Web-based System accessible through any major browser
- Single Click Report Export to Customer Tailored PowerPoint Report Templates
- Real Time Reporting
- Email Integration and Automated Reminders to Ensure Data Remains Fresh
- Automated Integration with Excel, Project and Other Applications
- Dynamic Charts: Risk Register, Risk Matrix (Heatmap) Risk Burndown (Waterfall)
- Military Grade Encryption and Secure Access Restrictions
- Ability to Add Customer Specific “Custom Data Fields”
- Statistical Analysis Functionality available in Expert Edition
Benefits
- Comprehensive and Flexible Enterprise Risk Management System
- Reduce Costs, Remove Uncertainty, Deliver Projects on Time and Budget
- Supports ISO 31000, PMBoK, ISO 27000 and COSO
- Quickly Embed Best Practice Risk Management and Increase Risk Awareness
- Ensure Consistent Risk Assessments and Develop Cost Effective Mitigation Strategies
- Deliver Accurate and Effective Management Information Instantly
- Ensure Timely Review of Risk, Issue and Opportunity Data
- Provide Secure Audit Trails for Enterprise Risk Management Activities
- Share Data Across Teams through Secure Database
- Simple, Intuitive, Easy to Use: Configure to Match User Requirements
Pricing
£10 to £50 a person a month
- Education pricing available
- Free trial available
Service documents
Request an accessible format
Framework
G-Cloud 10
Service ID
7 7 9 2 5 1 3 1 0 5 1 0 6 8 0
Contact
IRIS Intelligence Ltd.
Nayane Ferreira Huntriss
Telephone: 020 8798 0569
Email: nhuntriss@irisintelligence.com
Service scope
- Software add-on or extension
- No
- Cloud deployment model
- Private cloud
- Service constraints
- None.
- System requirements
-
- Recommended OS - Windows Server 2016, 2012 , or 2008R2
- Recommended DB – SQL Server 2008R2, 2012, 2014 or 2016.
- Oracle and other Entity Framework ADO.net supported databases
- Server RAM – minimum 2 GB free
- Free Hard Disk space 5GB Minimum
- CPU – Minimum 2 core , 1.4GHz
- Can be run on a shared or dedicated server
- Can be run virtualised if Host Machine has sufficient horsepower.
User support
- Email or online ticketing support
- Email or online ticketing
- Support response times
- Email support available 9 to 6, Mondays to Fridays. 24/7 Premium support for customers with larger teams, or upon premium service subscription.
- User can manage status and priority of support tickets
- Yes
- Online ticketing support accessibility
- WCAG 2.0 A
- Phone support
- Yes
- Phone support availability
- 9 to 5 (UK time), Monday to Friday
- Web chat support
- Yes, at an extra cost
- Web chat support availability
- 24 hours, 7 days a week
- Web chat support accessibility standard
- WCAG 2.0 A
- Web chat accessibility testing
- Included in focus groups
- Onsite support
- Yes, at extra cost
- Support levels
- Support through email and phone is available from 9 to 6, Mondays to Fridays. 24/7 Premium support for customers with larger teams, or upon premium service subscription.
- Support available to third parties
- Yes
Onboarding and offboarding
- Getting started
- The initial default settings of the risk management software system is compliant to the ISO 31000 and the PMBoK risk management standards. Users can access a dedicated help site with user documentation, and context sensitive help within the application. Upon purchase of the software, user training, either face-to-face or online, is provided.
- Service documentation
- Yes
- Documentation formats
-
- HTML
- ODF
- End-of-contract data extraction
- The client will be provided the underlying SQL databases upon contract completion. Spreadsheet formats of the data can also be produced for client records.
- End-of-contract process
-
All data can be extracted via Excel, XML, CSV or SQL Query.
General Assistance with the extraction process is covered within the maintenance helpline.
Import of the data into alternate system may be subject to additional charges
Using the service
- Web browser interface
- Yes
- Supported browsers
-
- Internet Explorer 7
- Internet Explorer 8
- Internet Explorer 9
- Internet Explorer 10
- Internet Explorer 11
- Microsoft Edge
- Firefox
- Chrome
- Safari 9+
- Opera
- Application to install
- No
- Designed for use on mobile devices
- Yes
- Differences between the mobile and desktop service
- Functionality is the same for both mobile and desktop services.
- Accessibility standards
- WCAG 2.0 A
- Accessibility testing
- Included in general focus groups
- API
- Yes
- What users can and can't do using the API
- All functionalities included.
- API documentation
- Yes
- API documentation formats
-
- ODF
- API sandbox or test environment
- Yes
- Customisation available
- Yes
- Description of customisation
-
Fully customisable using the standard user interface.
Users with administrative permissions can customise the system.
System also allows for local administrator access for lower level users to customise only those areas they are responsible for
Scaling
- Independence of resources
- Caching is used throughout the system to reduce demand on the database and increase the speed of user access. For the Monte Carlo analysis, there is a separate dedicated server on which it is run.
Analytics
- Service usage metrics
- Yes
- Metrics types
- Instantaneous and historical usage of license pools.
- Reporting types
- Real-time dashboards
Resellers
- Supplier type
- Not a reseller
Staff security
- Staff security clearance
- Conforms to BS7858:2012
- Government security clearance
- Up to Developed Vetting (DV)
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
- United Kingdom
- User control over data storage and processing locations
- Yes
- Datacentre security standards
- Complies with a recognised standard (for example CSA CCM version 3.0)
- Penetration testing frequency
- At least every 6 months
- Penetration testing approach
- In-house
- Protecting data at rest
-
- Physical access control, complying with CSA CCM v3.0
- Encryption of all physical media
- Data sanitisation process
- Yes
- Data sanitisation type
- Deleted data can’t be directly accessed
- Equipment disposal approach
- A third-party destruction service
Data importing and exporting
- Data export approach
- Data can be exported to spreadsheet and presentation formats. Users can upload their own templates for additional custom exports. Data Export API with export to JSON and XML. These files can be read directly by external applications such as R, Python, Tableau, Power BI etc.
- Data export formats
-
- CSV
- ODF
- Other
- Other data export formats
-
- Excel
- Powerpoint
- JSON
- XML
- Data import formats
-
- ODF
- Other
- Other data import formats
- Excel
Data-in-transit protection
- Data protection between buyer and supplier networks
-
- Private network or public sector network
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Data protection within supplier network
-
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
Availability and resilience
- Guaranteed availability
- Multiple options for guaranteeing availability are available, from cold start backup servers to hot mirroring.
- Approach to resilience
- Available on Request.
- Outage reporting
- Email alerts.
Identity and authentication
- User authentication needed
- Yes
- User authentication
-
- 2-factor authentication
- Public key authentication (including by TLS client certificate)
- Identity federation with existing provider (for example Google Apps)
- Limited access network (for example PSN)
- Dedicated link (for example VPN)
- Username or password
- Access restrictions in management interfaces and support channels
- IRIS software employs a role-based authorization within the system, where only an identified subset have access to management interfaces.
- Access restriction testing frequency
- At least every 6 months
- Management access authentication
-
- 2-factor authentication
- Public key authentication (including by TLS client certificate)
- Identity federation with existing provider (for example Google Apps)
- Limited access network (for example PSN)
- Dedicated link (for example VPN)
- Username or password
Audit information for users
- Access to user activity audit information
- Users have access to real-time audit information
- How long user audit data is stored for
- User-defined
- Access to supplier activity audit information
- Users contact the support team to get audit information
- How long supplier audit data is stored for
- At least 12 months
- How long system logs are stored for
- User-defined
Standards and certifications
- ISO/IEC 27001 certification
- No
- ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- No
- Other security certifications
- Yes
- Any other security certifications
- US Department of Defence Certificate of Networthiness
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- No
- Security governance approach
-
IRIS is fully aligned with ISO 27001 and the CSA CCM standards. We follow the standards set out for the Microsoft Azure platform set out here: https://cloudsecurityalliance.org/download/cloud-controls-matrix-v3-0-1/
Additional details can be obtained through the audit reports available from the Service Trust Portal at https://www.microsoft.com/en-us/TrustCenter/STP/default.aspx). - Information security policies and processes
-
Security is taken extremely important and is in the direct purview of the IT Director. Staff report directly about security matters and there is a no blame, and a report all, approach to security. This ensures that staff have not got any disincentives to report actual and potential security threats for further actioning.
In this environment staff feel comfortable checking the previous work of other staff members during regular security audits.
Operational security
- Configuration and change management standard
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Configuration and change management approach
- All changes are tracked using Microsoft's Team Foundation Service (TFS). No change can be made without being logged and as all builds, and tests, are automated, no release can be made without a change being recorded. From initial request to release is all performed, and tracked, within TFS. In the development early stages automated builds and tests act as gateways. A final manual test is run before release.
- Vulnerability management type
- Supplier-defined controls
- Vulnerability management approach
-
Staff subscribe to multiple security mailing lists and websites to keep abreast of the latest in security vulnerabilities.
When patches are released we update our own systems first. If there are no regressions we update our production servers. Security patches are typically approved within hours if there are no immediate regressions. If there are we investigate the scale and make a judgement as to the impact of the security vulnerability versus the scale of the patch regression. This typically happens on the day of release. - Protective monitoring type
- Supplier-defined controls
- Protective monitoring approach
- Intrusion detection software runs on all servers to monitor for suspicious activity. Anti-virus and anti-malware scans run regularly as well. On detection of a compromise resolution is the priority and all relevant staff are re-tasked to the job of resolution. Our preferred solution would be to restore from clean backups where possible onto a clean virtual machine, which leaves the original virtual machine free for forensics (In simulations this would take at most an hour).
- Incident management type
- Supplier-defined controls
- Incident management approach
-
The preferred method by which users can report events is through their assigned support contact who will provide up to date incident reports throughout the resolution process.
The staff have a number of predefined processes mostly designed to get the customer back up and running as quick as possible whilst allowing root cause analysis to be performed at a slower pace with no affect on the customer.
Secure development
- Approach to secure software development best practice
- Conforms to a recognised standard, but self-assessed
Public sector networks
- Connection to public sector networks
- No
Pricing
- Price
- £10 to £50 a person a month
- Discount for educational organisations
- Yes
- Free trial available
- Yes
- Description of free trial
- 14 day limited demonstration version