Frequently asked questions
General information
Implementation and usage
Methodology and standards
Integration and compatibility
Security, privacy and data
User management
Support and maintenance
Contact the IRAM3 team
General information
What is the IRAM3 Platform?
The IRAM3 Platform is an information risk management platform aligned to the IRAM3 methodology. It offers both qualitative and quantitative pathways to risk assessment. The IRAM3 Platform supports managing risk on an ongoing basis with an assortment of registers that provide a holistic view of your assets, assessments, risks and risk treatments, as well as an aggregated reporting capability, allowing you to communicate risk clearly to stakeholders.
Who is the IRAM3 Platform for?
The IRAM3 Platform has been built for individuals responsible for assessing or managing information risk. The platform has been designed to suit all levels of maturity, so whether you are just starting to build out a risk programme, looking to mature your approach, or are already using quantitative methods, the platform can support you.
The platform may also be of interest to:
executives, such as Chief Risk Officers, who want an aggregated view of information risk across the organisation to support reporting to the board and other stakeholders.
senior business and technology managers who need to track assets, assessments, risks and risk treatments in one place and connect information risk to the wider enterprise risk management approach.
auditors who want to review assessment records, risk registers and treatment progress to gain assurance over how information risk is assessed and managed.
Do I need prior risk management experience to use it?
No. The IRAM3 Platform has been designed to suit all levels of maturity, so you do not need to be a risk management expert to get started. The platform follows the IRAM3 methodology, giving you a structured and proven approach to assessing information risk from your first assessment.
To help you get started, quick start guides are available (LINK), and ISF offers complimentary introductory webinars and additional training workshops, which you can register for on the ISF Live calendar (LINK). If you would like further help getting started, please contact the IRAM3 team at mailto:support@iram3.org.
Implementation and usage
How do I get started with the IRAM3 Platform?
To get started with the IRAM3 Platform, log in to https://www.iram3.org (LINK) using your ISF credentials.
Quick start guides are also available here [Link to quick start guides] to help you get started quickly.
Is training provided for using the IRAM3 Platform?
ISF provides complimentary introductory webinars and overview sessions of the IRAM3 Platform, as well as additional in-depth training workshops. You can view our upcoming schedule and register for these events on the ISF Live calendar or email the IRAM3 team at support@iram3.org who will be happy to schedule a demo for you.
If you are interested in an in-depth training workshop but there is not one available in your region, or you would like a privately run workshop, please contact your ISF account manager, regional director or the IRAM3 team.
Methodology and standards
Which risk methodology does it follow, and can I adapt it to my own?
The IRAM3 Platform is aligned to the IRAM3 methodology, which uses a dual-track approach that supports both qualitative and quantitative assessment within a single, unified methodology. The platform is designed to be flexible, so many of the materials used in an assessment, such as business impact reference tables (BIRTs), threat catalogues and control libraries, can be tailored to reflect your organisation’s own approach.
Does it align with ISO 27001, ISO 31000, NIST or other frameworks?
Yes. Although the IRAM3 Platform is based on the IRAM3 methodology, it has been designed to be flexible. Organisations can customise assessment materials, including threat catalogues and control libraries, to align with their chosen standard or framework.
The default control libraries are aligned to the ISF Standard of Good Practice for Information Security (SOGP), which is mapped to a wide range of industry standards and frameworks, including ISO/IEC 27002, NIST CSF 2.0, CIS Controls and PCI DSS.
Can I use my own risk scales, appetite and thresholds?
Yes. The IRAM3 Platform allows you to customise assessment materials, including the rating scales, BIRTs and risk appetites. This helps ensure that assessment results are consistent with your wider enterprise risk management approach and are meaningful to stakeholders.
What control library is used?
The IRAM3 Platform includes two default control libraries: Security Radar and Security Healthcheck. Both are aligned to the SOGP and provide a comprehensive set of controls that is consistent with other ISF tools.
Security Radar consists of about 80 questions covering the 25 categories in the SOGP, and is suited to high-level assessments that need to be completed quickly. For a more in-depth assessment, Security Healthcheck provides more detail, with over 500 questions covering 164 topics of information security best practice.
You can also create your own control libraries, for example to reflect an internal control framework or the controls required by a specific regulation.
Integration and compatibility
Can IRAM3 be used with AI?
Yes. The IRAM3 Platform can be connected to AI assistants using the ISF Model Context Protocol (MCP) server. This allows you to carry out work in the IRAM3 Platform directly from your AI assistant’s interface. Examples include creating new risk assessments, adding or reviewing assets in the asset register, and adding risk treatment activities to a connected project management tool, such as Jira.
The ISF MCP server can also be used to query the SOGP and ISF research library, allowing you to use ISF resources from the AI tools you already use every day.
What is an MCP server?
Model Context Protocol (MCP) is an open standard that allows AI assistants and other applications to connect to external systems in a consistent and controlled way. An MCP server is the component that makes a system’s data and functions available through this standard. The ISF MCP server gives compatible AI tools access to the IRAM3 Platform, the SOGP and the ISF research library.
Does it integrate with other tools, such as ticketing or existing governance, risk and compliance (GRC) systems?
Yes. Using the ISF MCP server, assessment outputs can be extracted from the IRAM3 Platform and automatically added to Jira or similar platforms.
How can I use the ISF MCP server?
To access the ISF MCP server, please contact your ISF account manager or regional director.
Security, privacy and data
Where is the data from the IRAM3 Platform stored?
By default, the IRAM3 Platform is hosted in the Microsoft Azure UK South data centre.
We also offer alternative hosting arrangements, such as regional cloud or private hosting (including on premises). If you are interested in these options, please contact your ISF account manager, regional director or the IRAM3 team.
How is data encrypted and backed up?
All sensitive data is protected using industry-standard AES-256 encryption for data at rest and in transit. All data sent to and from the site is encrypted. We use TLS 1.3 where supported, with TLS 1.2 as the minimum.
Daily backups are performed and stored on redundant Azure West infrastructure. Geo-redundant backups are maintained for additional protection. Backups are tested regularly to confirm their integrity and that they can be restored.
Further information on how ISF protects your data is available on the ISF trust centre.
What certifications or assurance can you provide?
ISF maintains ISO/IEC 27001 certification. Our certificate and security policies are available on the ISF trust centre.
What security protocols are implemented in the IRAM3 Platform?
ISF is committed to maintaining high standards of security, privacy and compliance. All ISF tools are built using security-by-design principles, and independent security specialists carry out a comprehensive testing programme every year.
More information on our security protocols is available on the ISF trust centre.
Do you support single sign-on (SSO)?
Yes. All ISF tools can support SSO. If you are interested in enabling SSO, please contact your ISF account manager or regional director.
User management
Who in my organisation can access the IRAM3 Platform?
Anyone with ISF login credentials can access and use the IRAM3 Platform.
What user roles are available in the IRAM3 Platform?
The IRAM3 Platform permission model includes four roles:
Admin
Full visibility and capability across all working groups, with the ability to create working groups and manage all users.
Coordinator
Full visibility and capability within their working group, with the ability to manage users in that working group only.
Sub Coordinator
The ability to view and edit only the assessments they create or are assigned to, without the ability to manage other users.
Standard User
Read-only access to the assessments assigned to them, without the ability to edit assessments or manage other users.
ISF Admins are originally defaulted to your organisation’s ISF Primary and Secondary contacts. All other users are initially assigned as Sub Coordinators within the default working group. Primary and Secondary contacts can also assign admin permissions to other users.
Further information on how to manage users is available in our quick start guides (LINK).
What is a working group?
ISF Member organisations differ in size and structure. Many Members are multinational organisations, consist of multiple subsidiaries or have multiple teams that use ISF resources but work independently of each other.
The working group capability allows separate spaces to be created within the IRAM3 Platform. Each entity within a Member organisation can have its own dedicated space, with full control over which users have access to it.
Admin users can create new working groups and assign users to them, and Coordinator users can manage users within their own working group.
Further information on how to use the working group feature is available in our quick start guides (LINK).
Support and maintenance
What support is available for IRAM3 Platform users?
Members can contact the IRAM3 team using the dedicated support inbox: support@iram3.org. For additional support, email the inbox to schedule time with a member of the tools team, or contact your account manager.
How can I provide feedback on the IRAM3 Platform?
We welcome feedback on how you use the IRAM3 Platform and how it supports your information risk management. You can provide feedback here [link to Foleon feedback form page that forwards to support@iram3.org]. You can also discuss the IRAM3 Platform with your account manager.
How are updates and new features communicated?
New features are announced on the product change log (LINK).
We also post regular updates on the IRAM3 community page, where you can also find discussions from the ISF Global Team and other ISF Members about IRAM3.
Can't find what you're looking for?
If your question is not covered contact the IRAM3 team