Use case. I'm an ISO 27001 consultant deploying self-hosted Probo per customer. Organizations arriving at Probo typically have an established risk assessment methodology, often a 4×4 matrix, or custom level labels ("Rare/Unlikely/Possible/Likely/Certain"), documented in their ISMS and already accepted by their auditors. Adopting Probo shouldn't force a methodology change: for existing ISMSs, the methodology document is authoritative and the register tool should follow it.
Current behavior. Likelihood and impact are fixed 1–5 integers — inherent_likelihood/inherent_impact etc. in pkg/coredata/risk.go, enforced as 1–5 in the prb risk create flags. No organization-level configuration of level count or labels.
Proposal. Make the risk scale an organization-level setting rather than a hardcoded constant: number of levels per dimension (e.g. 3–7) and optional display labels per level. The setting would default to the current built-in scale, so existing organizations and stored risk data are unaffected by the upgrade — only organizations that explicitly configure a different scale see different level options.
Defaults preserve today's behavior, so existing data and the current UI are unaffected.
Workaround today. Mapping customer scales onto 1–5 at import time via GraphQL and re-rendering labels in a front-end layer works, but the labels shown in Probo's own console don't match the customer's documented methodology, which auditors notice.
Happy to discuss the design or contribute a PR if maintainers are open to it.
Use case. I'm an ISO 27001 consultant deploying self-hosted Probo per customer. Organizations arriving at Probo typically have an established risk assessment methodology, often a 4×4 matrix, or custom level labels ("Rare/Unlikely/Possible/Likely/Certain"), documented in their ISMS and already accepted by their auditors. Adopting Probo shouldn't force a methodology change: for existing ISMSs, the methodology document is authoritative and the register tool should follow it.
Current behavior. Likelihood and impact are fixed 1–5 integers — inherent_likelihood/inherent_impact etc. in pkg/coredata/risk.go, enforced as 1–5 in the prb risk create flags. No organization-level configuration of level count or labels.
Proposal. Make the risk scale an organization-level setting rather than a hardcoded constant: number of levels per dimension (e.g. 3–7) and optional display labels per level. The setting would default to the current built-in scale, so existing organizations and stored risk data are unaffected by the upgrade — only organizations that explicitly configure a different scale see different level options.
Defaults preserve today's behavior, so existing data and the current UI are unaffected.
Workaround today. Mapping customer scales onto 1–5 at import time via GraphQL and re-rendering labels in a front-end layer works, but the labels shown in Probo's own console don't match the customer's documented methodology, which auditors notice.
Happy to discuss the design or contribute a PR if maintainers are open to it.