What the risk would cost you
A loss estimate that goes on the assessment itself, put there by the same colleague who is already weighing how bad it would be and how likely it is. It is not a separate finance exercise bolted on afterwards.
Put a number on the risk, and on what it costs to fix
When more mitigation work lands on your desk than there is budget for, the order has to come from arithmetic: what a risk would cost you if it happened, where that figure lands once a plan is done, and what the plan itself costs. You supply the estimates. The platform holds them together and keeps the reasoning attached.
Unlimited users • Free onboarding and support • No commitment
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=34&height=26&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png){kind=small}
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=225&height=26&name=KAUFMANN%20(1).jpg){kind=small}
Risk exposure and mitigation cost
Meridian's security spend now gets decided on the arithmetic
Every autumn Anders Krogh goes into Meridian Nordic's budget round with more mitigation work in front of him than there is budget for. He is the group's security lead, he answers for risk across three countries, and the case he could make used to be a list of risk levels and a request. Two risks sitting at the same level told nobody which one to deal with first. Now each assessment can carry what the risk is estimated to cost if it happens, each plan says what it will cost and where the exposure is expected to land afterwards, and Anders arrives with a difference and a price per plan.
-
Exposure before, exposure after, and the cost of getting from one to the other, all on objects that already exist.
-
Five competing plans go into an order, because there is finally something comparable to sort them by.
-
The risk level expected on completion is written down before anything is committed, not reported once it has been.
-
The case that won the budget is the same case that travels upwards, so it is not rebuilt for the meeting.
Risk exposure and mitigation cost
More work than budget, and nothing to rank it on
The register does its job. Anders can see what sits above appetite and what does not. The awkward part starts one step later, when he has to choose which of those things gets dealt with this year.
-
A risk level compares to another risk level and stops there. It tells you about severity, not about what fixing it is worth.
-
The colleague holding the budget does not think in levels, so the case gets rebuilt in a different language every time it is made.
-
The cheapest fix and the most useful fix are rarely the same fix, and nothing on a matrix says which is which.
Risk exposure and mitigation cost
The loss estimate belongs on the assessment
The first of the three figures sits where the risk is assessed rather than in a separate financial exercise. Whoever states the consequence level and the probability level can put a figure on the loss at the same time.
-
It is your estimate of what the risk would cost if it happened, filed next to the justification that consequence and probability each require anyway.
-
It is optional. A risk area can run on its levels alone, and plenty will, which is a legitimate way to work rather than a half-finished setup.
-
Estimate to compare, not to audit. What the decision uses is the order of magnitude and the direction, and being consistent across your entities matters far more than being exact on any one of them.
Risk exposure and mitigation cost
The difference is the number worth arguing from
The other two figures live on the mitigation plan, and the useful one is the distance between them. Exposure now, exposure once the work is done, and the gap that separates the two.
-
The plan says where the exposure is expected to land afterwards, so the reduction is on the record instead of being asserted in a meeting.
-
It also says what the work is expected to cost, which turns a plan into something with two sides rather than a request with one.
-
And it carries the risk level expected on completion, so the effect is stated in the same terms the register already runs on.
Risk exposure and mitigation cost
Five plans, one order
This is the part of the job that has no honest answer without figures. Line up the three numbers behind each open plan and the plans stop competing on who asked most persistently.
-
A large reduction for a modest cost is easy to defend, and a modest reduction for a large cost is easy to defer. The interesting plans are the ones in between, and they are the ones that used to be invisible.
-
Nothing is ranked for you. The platform puts the figures next to each other, keeps them attached to the assessment they came from, and leaves the ordering to a person.
-
Because the reasoning is stored with the numbers, next year's round starts from what you decided last year rather than from what anyone remembers.
Risk exposure and mitigation cost
The same figures carry upwards
The numbers are entered once, on individual assessments and plans, and they aggregate on their own. Nobody rebuilds the argument in a spreadsheet to answer the question one level up.
-
Exposure and plan cost roll up to risk area level, so an area's totals come out of the entities inside it rather than out of a separate exercise.
-
The management report gathers the same figures across areas, which means management reads the arithmetic you already did rather than a fresh version of it.
-
What that report actually contains, and how it is handed on, is a different job with a page of its own.
Risk exposure and mitigation cost
Every number in here is one of yours
This is the part we put in writing rather than leave for a demo to find. The platform has no idea what an outage would cost Meridian, and it does not pretend to.
-
There is no benchmark, no industry table and no loss model behind the exposure field. Somebody at Meridian estimated it, with a justification attached and a timeline that keeps it.
-
What the platform contributes is the sum and the paper trail. It does not put a price on your risk, and it does not tell you which plan to fund.
-
It documents risk rather than detecting it. Nothing here scans your estate or finds a risk you have not written down. We build the plan, not the filling-in.
Our Customers
+400
companies
+11.000
users
+79.000
contracts
+14.000
processing activities
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
Use cases
Book demo
Find the job you need done
Every use case is a real piece of compliance work, told the way it actually runs in the platform. Filter by who you are, what you work with, and which frameworks you answer to.
Compliance & GRC leadCISO & IT securityDPOLegal counselExecutive & board
Energy & utilitiesFinancial servicesManufacturingPublic sectorHealthcareProfessional servicesRetail & e-commerceTechnology
SMVMid-marketEnterprise & group
GDPRNIS2ISO 27001CIS18DORAePrivacyAI ActD-mærketData Act
Compliance & GRC lead
Build one risk register for the whole organisation
One register across GDPR, NIS2, AI and information security, where each risk area keeps its own matrix, scale and appetite. Delivered by the Enterprise Risk Management add-on.
See the risk register
Executive & board
Give the board a risk picture it can act on
One management report across every risk area: entities assessed, risks above appetite, exposure now and once the open plans are done. Export it with your own comment on it.
See board risk reporting
Compliance & GRC lead
Run awareness training that reaches every colleague
Send out training and policies, chase the stragglers automatically, and prove every colleague completed it. You bring the material, we run the rails.
See awareness training
Compliance & GRC lead
Manage compliance across a group of companies
Run every company in the group from one platform, document once at group level, and still report entity by entity. Delivered by the Group Companies add-on.
See group compliance
Legal counsel
Run due diligence on your vendors
Classify a vendor on your own criteria, get the answers and documents you need with no login for them, and move the approved ones straight into contracts.
See vendor due diligence
Compliance & GRC lead
Multi-framework compliance: do the work once
Do a control once and it counts across every framework it maps to, with a simulated score on the ones you haven't started yet.
See multi-framework compliance
CISO & IT security
Get NIS2-ready without starting from scratch
Build on the ISO 27001 work you've already done, switch NIS2 on, and let a simulated score show how far ahead you already are.
See NIS2 readiness
DPO
From twelve spreadsheets to one record of processing
Your GDPR documentation already exists, it just lives in spreadsheets. Export what you have and we structure it in .legal for you, typically inside two weeks.
See the move off spreadsheets
CISO & IT security
Run your ISMS in one platform
The frameworks you answer to, the controls beneath them and the documentation that proves the work happened, all three in one module, with status updating itself from completed tasks.
See how the ISMS runs
DPO
Keep your records of processing always audit-ready
The Article 30 record is a report drawn from your processing activities, not a document you rebuild before an inspection. Correct an activity and the record says so immediately.
See the record stay current
Compliance & GRC lead
Get ready for the D-seal
D-Seal's own criteria sit in the platform under a formal agreement with D-Seal, mapped 1:1 with the level 3 criteria. Work the controls, collect the documentation, export it per task.
See the D-seal route
Legal counsel
Contract management with obligations and renewals
Register what each contract obliges you to do, delegate it as tasks with deadlines, and see in one overview that it gets done on time. Renewals notify ahead of the date.
See obligations and renewals
CISO & IT security
Achieve and maintain ISO 27001 certification
The certificate is won at the audit and kept alive in the years between. Work the controls under the standard's own numbering and plan the whole cycle in one pass.
See the certification route
CISO & IT security
One incident log for GDPR and NIS2
A personal data breach and a security incident go in the same register, on the same form. Record it, attach the documentation, delegate the follow-up, and export it when somebody asks.
See the incident log
CISO & IT security
Secure the supplier chain NIS2 holds you responsible for
Register the supplier, classify it on criteria you set yourself, get the answers and documents out of it without a login, then assess it as a risk in your NIS2 risk area.
See the supplier chain end to end
DPO
Every data processing agreement, and the ones that are missing
Put every data processor next to its agreement and the gaps stop hiding. Register the agreement once, reference it from everything that relies on it, and change it in one place.
See the agreements and the gaps
Legal counsel
Put AI to work on your contract portfolio
Three jobs AI does on contracts today: it fills the register from the document you already have, checks a contract against your own best practice, and answers questions across the portfolio. All of it in beta.
See AI on the contract portfolio
Compliance & GRC lead
Hand over everything a colleague was responsible for
Somebody leaves and their name is still on contracts, processing activities, assets and the tasks that document your controls. One table lists every place they are named as responsible, and you hand each role to the colleague who should have it.
See the handover
CISO & IT security
Catch the risk when somebody notices it
One public link with no login, so a colleague can report what they spotted from a phone in half a minute. It lands in an inbox with an owner, where a person decides whether it becomes a risk scenario.
See how an observation lands
DPO
Run your DPIAs where the processing activity already lives
Run a DPIA as an internal assessment on the same audit engine you already send questionnaires with. You write the questions yourself, and when the answers come back you relate them to the processing activity they concern.
See DPIAs on the activity
DPO
Map your personal data to the systems that hold it
Start from the system and see which personal data sits in it, gathered from every processing activity it's attached to. Nothing is scanned for you.
See the system's personal data
CISO & IT security
Know who has signed off which version of the policy
Publish a policy version, then ask for sign-off as a separate step. Each version keeps its own log of who has signed off and who is still missing.
See sign-off per version
No use cases match that combination yet. Try removing a filter.