> For the complete documentation index, see [llms.txt](https://docs.cortex.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.aic.io/menu-areas/police-and-defence/protective-risk.md).

# Protective Risk

**Open this area:** In the CORTEX menu, select **Police operations → Protective risks**.

Retain evidenced threats, qualitative likelihood and consequence, controls, actions and separate accountable residual-risk decisions.

**Who uses this:** Reviewer, Administrator.\
**Open in CORTEX:** `/security/risks`.\
**In-app guide:** `/help?topic=protective-risk`.

**Expected result:** Asset and role risks remain reviewable without named-person scoring, surveillance or an unsupported compliance claim.

## Before you start

* Select the correct workspace. Reading uses security.read and complete handling; changes use security.manage. Existing access is never expanded by naming an owner.
* Gather actual threat and control evidence. Role assessments describe functions and access, never a named person's characteristics or inferred score.
* Obtain any applicable sponsor input through its authorised channel. Do not invent restricted clauses or infer accreditation.

## What to do

{% stepper %}
{% step %}

## Register the protected target

The prerequisite panel shows management access, owner selection and the exact approved role needed for a role assessment.

Use Target, Controls, Threats, Mitigation and Review steps for registration; revisions skip Mitigation because retained actions remain separate.

Define the boundary, criticality and accountable owner, then select complete handling. Red steps list missing input and green steps are ready.
{% endstep %}

{% step %}

## Record the assessment

Complete every control's design, evidence, observed effectiveness and reasoning before proceeding to Threats.

Describe each threat and its evidence, choose qualitative likelihood and consequence, explain both and link relevant controls. CORTEX does not calculate a risk or person score.

Mitigation then needs an action, future due date and supporting evidence; sponsor input is optional but must be complete if entered.

Review needs a reason before the single final save.
{% endstep %}

{% step %}

## Revise current evidence

From risk detail choose **Revise assessment**.

The shared form edits all current threats, controls and links while preserving their stable identities and every independent action or decision.

Reload after a conflict; a successful revision makes earlier acceptance historical.
{% endstep %}

{% step %}

## Assign mitigation

Name an authorised owner, due time and supporting evidence for each action.

Only that owner records completion evidence. Completion does not accept the remaining risk.
{% endstep %}

{% step %}

## Review incidents

Find and select an incident you are currently authorised to read, then state its effect on risk and controls.

The link pins its retained version and hash. Incident resolution does not close mitigation or accept residual risk.
{% endstep %}

{% step %}

## Make the owner decision

The asset or role owner records a separate time-bounded acceptance for the current risk version, with basis and explicit change triggers.

Expiry or any later risk revision requires a new decision.
{% endstep %}

{% step %}

## Review publication exposure

The risk detail page guides this separate review through Publication, Assessment and Review decision.

First obtain the exact internal title, reference, revision and content SHA-256; red step markers and the missing-input list identify anything still required.

Then record observed exposure findings and a defensive recommendation. Review the outcome and give a reason before the single final save.

Back preserves the unsaved assessment; Clear review draft affects only local entries.

This performs no reconnaissance and does not authorise publication. Saving appends a risk revision and makes any previous residual acceptance historical.
{% endstep %}

{% step %}

## Record sponsor readiness

Keep each sponsor requirement separate as missing, supplied or assessed.

Restricted input that has not been supplied stays missing. Assessed records consideration of supplied material; it is not a compliance statement.
{% endstep %}

{% step %}

## Recover safely

Reload after a concurrent edit.

If a linked incident, role or system is unavailable or changed, restore the owning-record access or make a new authorised assessment; no cached title, count or dependency detail is returned.
{% endstep %}
{% endstepper %}

## Check the result

* Are the target boundary and current supporting pins exact?
* Does every category have evidence and written reasoning?
* Are action ownership and residual-risk acceptance separate?
* Are sponsor inputs and publication authority described honestly?

## If you get stuck

<details>

<summary>Does resolving an incident close the risk?</summary>

No. Incident review, action completion and residual-risk acceptance are separate retained decisions.

</details>

<details>

<summary>Can I assess a named employee?</summary>

No. A role assessment covers the functions, access and controls of an approved role. Do not enter personal traits, behaviour or a person score.

</details>

<details>

<summary>Does Assessed mean compliant?</summary>

No. It means the supplied sponsor input was considered. Accreditation, contract compliance and publication authority remain separate accountable processes.

</details>

## Responsibility and limits

* Risk records are retained controls. Their incident, system and role references prevent upstream disposal through the shared conservative dependency inventory; this feature does not create a new deletion scope.
* Current access to every historical linked record is rechecked before returning a risk or search page. A dependency access failure makes the whole page unavailable rather than disclosing hidden counts.
* History is append-only and bounded to 64 revisions. A local digest protects application integrity but is not independent evidence custody.

**Reference and scope:** F20 stories 6342–6346. Actual sponsor requirements and restricted NPSA or Defence material must be supplied through authorised channels before assessment.

## Related workflows

* [Record and manage a defensive security incident](broken://pages/686a1f32f9bd42ca2b59d170632ad3d57be6a73e)
* [Track incident reporting and corrective actions](broken://pages/ca09bc7434b5a64dc02686b95d9cfc9a5e799e01)
* [Maintain a system control and evidence baseline](broken://pages/699956df97c18fc4ddd8894884fea67a7b6e90ce)
* [Enable reviewed personnel eligibility](broken://pages/59b6d474874739236ead2fadcb61a0a9479b1abd)
* [Manage accounts, grants and workspace membership](broken://pages/99c8701bc497eefb32769b668198b1f9f5fc6a93)