This module allows you to manage feared events (security incidents) of your Information Security Management System (ISMS) and assess their risk using a configurable risk matrix.
Key concepts:
- Feared Events — Security incidents that could impact your organization, each classified by the security properties they threaten: Confidentiality, Integrity, and/or Availability (CIA triad).
- Attack Vectors — The means by which a threat could materialize. Each vector carries three risk ratings (probability × severity): Original (before any control), Current (with controls already in place), and Residual (after planned remediation). A feared event's overall rating is automatically computed as the maximum across all its vectors.
- Scenarios — Links between a feared event, an attack vector, and a threat source, with a description of how the attack could unfold.
- Threat Sources — The origin of a threat (e.g. external attacker, malicious insider, compromised supplier).
- Security Controls — Countermeasures applied to reduce risk, each flagged as Prevention, Protection, and/or Recovery.
- Assets — Primary assets (the information or processes to protect) and Supporting assets (the infrastructure that hosts them), organized by category.
- Risk Matrix — A visual heat-map report that plots feared events by probability and severity for a chosen risk type (original, current, or residual), with color-coded cells (green / orange / red).
auto_awesome What this module does
AI-generated from the code · Odoo 19.0Manage feared security events for your ISMS: record assets, attack vectors, threat sources and controls, then rate each event and print a colour-coded risk matrix.
This module adds a Security area to your Management System for documenting information-security risks.
- Under Security > Assets you register Primary Assets (with a responsible person) and Supporting Assets (with a category and links to the primary assets they support).
- You also maintain Threat Sources, Vectors (the ways an attack could happen, each with original, current and residual probability and severity) and Security Controls, which can be linked to a work instruction document.
- Feared Events are the core records: each one flags whether it threatens Confidentiality, Integrity and/or Availability, and holds Scenario lines (vector + threat source + description) and Control lines (control + supporting asset, marked as prevention, protection or recovery).
- The event's original, current and residual probability and severity are computed automatically as the highest value found among the vectors used in its scenarios.
- A Risk Matrix wizard (Reports menu) lets you choose the rating type and print a report; matrix levels define probability/severity ranges and a colour (green, orange, red), and overlapping levels are refused.
- Access rights follow the usual viewer/user/auditor/manager roles.
Depends on
Required by other modules
Menus it adds
Models and fields (11)
- mgmtsystem.risk.matrix · new modeltype, system_id, company_id
- mgmtsystem.security.event · new modelintegrity, system_id, company_id, control_ids, severity_id, availability, scenario_ids, confidentiality, document_page_id, current_severity_id, original_severity_id, residual_severity_id, current_probability_id, original_probability_id, residual_probability_id
- mgmtsystem.security.vector · new modelname, system_id, company_id, description, current_severity_id, original_severity_id, residual_severity_id, supporting_asset_ids, current_probability_id, original_probability_id, residual_probability_id
- mgmtsystem.security.control · new modelname, system_id, company_id, description, work_instruction_id
- mgmtsystem.risk.matrix.level · new modelcolor, severity_max, severity_min, probability_max, probability_min
- mgmtsystem.security.asset.primary · new modelname, system_id, company_id, description, responsible_id
- mgmtsystem.security.event.control · new modelrecovery, system_id, control_id, prevention, protection, security_event_id, supporting_asset_id
- mgmtsystem.security.threat.source · new modelname, system_id, company_id
- mgmtsystem.security.asset.category · new modelname
- mgmtsystem.security.event.scenario · new modelsource_id, system_id, vector_id, description, probability_id, security_event_id
- mgmtsystem.security.asset.supporting · new modelname, system_id, company_id, category_id, primary_asset_ids
Text generated by AI (DeepSeek) from reading the Odoo 19.0 code on GitHub; it may contain mistakes, so check the code before deciding. The module is very large and only part of the code was read. View the code on GitHub
Availability by version
Reviewed: 2026-11-03Confirmation status: 1 confirmed, 8 with no information of 9 versions.
Sources · Odoo 19.0
Confirmed on 2026-11-03 in branch 19.0 of OCA/management-system.
terminal Installation and usage
OCA documentation · Odoo 19.0Configuration
Source · Odoo 19.0Risk Matrix Levels
Define which cells in the risk matrix are green, orange, or red.
Go to Management System > Configuration > Security > Risk Matrix Levels and create one record per zone. Each level covers a rectangular region of the matrix defined by a probability range and a severity range. Ranges must not overlap.
A default 4 × 4 matrix configuration is installed with the module. Adjust it to match your organization's risk appetite.
Assets and Threat Sources
Before creating vectors and events, populate the reference data:
- Management System > Manuals > Security > Assets > Primary Assets — the information assets or business processes you need to protect.
- Management System > Manuals > Security > Assets > Supporting Assets — the servers, software, and infrastructure that host primary assets. Link each supporting asset to the primary assets it carries.
- Management System > Manuals > Security > Threat Sources — the actors or causes that could exploit a vector (e.g. external attacker, malicious insider).
Usage
Source · Odoo 19.0Typical workflow
- Create attack vectors
Go to Management System > Manuals > Security > Vectors and create one record per attack vector. For each vector:
- Set the Original probability and severity (risk without any control).
- Set the Current probability and severity (risk with existing controls).
- Set the Residual probability and severity (risk after planned remediation).
- Optionally link the supporting assets that are exposed by this vector.
- Create security controls
Go to Management System > Manuals > Security > Controls and create the countermeasures available in your organization.
- Create feared events
Go to Management System > Manuals > Security > Feared Events and create one record per feared event. For each event:
- Tick the Confidentiality, Integrity, and/or Availability flags that the event threatens.
- In the Scenarios tab, add one line per attack scenario: select the vector and threat source, and describe how the attack could unfold. The event's risk ratings (probability and severity) are automatically computed as the maximum across all linked vectors.
- In the Controls tab, add the controls that mitigate this event. For each control line, indicate whether it acts as Prevention, Protection, and/or Recovery, and optionally link the specific supporting asset it protects.
Use the search bar to filter events by Confidentiality, Integrity, or Availability, or group them by system or severity.
- Generate the risk matrix
Go to Management System > Manuals > Security > Risk Matrix, select the risk type (Original, Current, or Residual), and click Done to generate the PDF report. Each cell shows the feared events at that probability/severity intersection, color-coded by the configured risk level.
No verified information in OCA: Installation.
Installation instructions, the distribution package, dependencies and configuration steps are not shown because they have not yet been verified in the module documentation for any version.
Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.