Associate Threats and Controls
In order to link Controls and Threats, navigate to the Risk Register at the top. You can assign more than one Control from a Threat detail page or assign one or more Threats on a Control detail page. You can associate Threats and Controls together, regardless of whether they’ve been registered.
The system-defined Threats come with Controls already associated with them.
Assign from Registered Threat Page
From the Risk Register, select one of your Registered Threats.
Under Registered Controls, select Add Controls.
A modal will appear. If you need, filter by tag at the top.
Check the box next to each Control you’d like to add.
Select Submit.
Once you add a Control, the Threat’s Residual Risk Level will adjust based on the Likelihood Reduction Value of the Control.
Assign from Registered Control Page
You can also associate one or more Threats to a Control from a Registered Control page. The steps are the same as above, but instead, select a Registered Control from the Risk Register followed by Associate Threats.