Know your biggest risks, and what they’d cost you.
Bastion Control puts your risk register, business impact analysis (BIA) and supplier assessments in one place, connected to your recovery plans and your compliance controls, so a risk on paper becomes action you can track.
Risk registers live in spreadsheets nobody updates.
Business impact analyses are done once for an audit and never connected to the recovery plan. Supplier assessments are chased by email, and the answers end up in someone’s inbox. When the board asks which risks matter most, and what they’d cost, nobody can answer with confidence.
Control is where risk connects to action. A gap in your BIA leads straight to a disaster recovery (DR) plan. A risk links to the compliance controls that treat it, and you’re warned when a serious risk’s controls aren’t actually in place.
From risk on paper to risk you can act on
Build your risk register
Start from pre-built risk templates or add your own. Score each risk by probability × impact and see where it sits on the heat map.
Put a number on it
Enter single loss expectancy (SLE) and annual rate of occurrence (ARO) to get annual loss expectancy (ALE). Your dashboard totals your expected annual cyber risk.
Map what the business can’t lose
Record business functions with maximum tolerable outage (MTO), recovery time objective (RTO) and recovery point objective (RPO). BastionIQ flags where your DR plans can’t meet them.
Connect it to action
Link risks to the compliance controls that treat them and the infrastructure they affect. Create a DR plan for any business function with a gap in one click.
What’s included in Bastion Control
Risk register with heat map
Probability × impact scoring, pre-built risk templates, and mitigation plans with an owner and a cost. Link risks to your infrastructure, and let AI suggest a risk narrative so you’re not starting from a blank box.
Financial quantification
Single loss expectancy × annual rate of occurrence = annual loss expectancy for every risk, with a dashboard total for your expected annual cyber risk.
Risks linked to compliance controls
Each risk links to the controls that treat it in ISO 27001, Cyber Essentials, SOC 2, GDPR and NIS2. Templates arrive pre-mapped (Ransomware maps to ISO 27001, Cyber Essentials, SOC 2 and NIS2 controls), and AI can suggest more.
Untreated-risk warnings
If a Major or High risk’s linked controls are all still not started or in progress, Control warns you. With Bastion Comply active, you see each control’s live status.
Technical risks
Log lower-level findings with severity and remediation status. Link each one to the business risk it rolls up to and the infrastructure it affects.
Business impact analysis
Business functions with MTO, RTO and RPO, impact narratives and dependencies. Automatic RTO-gap detection against your DR plans, with a one-click “Create DR plan for this function”.
Supplier risk assessments
A supplier register with Gold, Silver and Bronze criticality and a custom questionnaire builder. Suppliers answer through a secure one-time link verified by an emailed code, so they don’t need a BastionIQ account. You keep the full response history.
Scheduled reviews
Set re-assessment cycles across risks, BIA functions and suppliers, so your register stays current after the audit is over.
Reports you can put in front of the board
Risk register, business impact analysis and supplier reports you can hand to the board, an auditor or your insurer.
Take your risk, BIA and supplier data into your own reporting or board pack.
Save any report straight to Bastion Vault, with full version history alongside the rest of your evidence.
Where Control connects
Risks link to the controls that treat them, with live control status and warnings when a serious risk’s controls aren’t in place.
Learn more →Risks and technical findings link to the systems they affect, in the same register that feeds your plans, exercises and incidents.
Learn more →Your expected annual cyber risk, in pounds rather than colours.
A heat map tells you what’s red. Annual loss expectancy tells you what it would cost. Put that next to the cost of each mitigation plan, and you can show exactly where the next pound of security budget should go.
See your risk in pounds, not guesswork.
Free 30-day trial with Control included. On paid plans, Bastion Control is +£42/month.