The tools section holds interactive worksheets that apply the methods described in the guides. At the moment there is one, and it is deliberately small.
IT risk assessment matrix
The IT risk assessment matrix lets you enter named IT risks with a likelihood and an impact from 1 to 4. It multiplies them into a score, bands the score as low, medium, high or critical, plots every risk on a 4 by 4 matrix, ranks them, and lists the kind of treatment worth examining first for each. You can add a planned residual score for risks you intend to treat, choose a threshold above which risks are flagged, and copy a plain-text summary or a tab-separated table that pastes into a spreadsheet.
It runs in your browser. Nothing you enter is sent anywhere or stored, and the page works without any account.
What the tools do and do not do
These tools are rule-based worksheets. They calculate from the values you give them using rules that are printed on the page, so you can see exactly how an output was reached and challenge it. They do not inspect, measure, scan or test any real system, and a result is a working estimate, not a certification, an audit, an attestation or evidence of compliance.
For the thinking behind the scoring method, including where multiplying ordinal scores misleads, read the risk scoring guide. For what to do with the ranked list, read risk treatment.