Retire the risk spreadsheet. Keep your risk data.
Rosco is an ISO 31000 risk register that you host yourself. Each business unit sees what it should, every change is on the record, and Ask Rosco, the AI risk manager, drafts the work for you to check and apply.
- On your servers. Your risk data never comes to us.
- No card for the trial. Enterprise features, 30 days.
Example draft
Key supplier outage
Above your Operational appetite of Medium. I've drafted a treatment plan with two actions for you to check. Nothing changes until you apply it.
The whole ISO 31000 process, in one register
Most risk registers live in spreadsheets, because the alternative has been handing your most sensitive information to a software vendor. Rosco removes that trade. It follows ISO 31000:2018 from context to reporting, runs on your own infrastructure, and lets each business unit work on its own risks while the group sees the whole picture.
Context and criteria Clause 6.3
Context, stakeholders, obligations and objectives for each business unit. Your own risk matrix from 3×3 to 7×7, consequence descriptions for each impact area, and appetite and tolerance for each category.
Identify and analyse Clause 6.4
Bow-tie risks: causes, event and consequences, with controls placed as barriers. Inherent, current and target ratings with the reasoning and confidence behind them, plus scenarios and emerging risks.
Evaluate Clause 6.4.4
Every rating is checked against appetite: within appetite, above appetite or above tolerance. Each approval and review records a decision, and nothing above tolerance passes without formal acceptance.
Treat Clause 6.5
Treatment plans with the ISO options, actions, owners and due dates; overdue actions escalate. Acceptance requests go to the person your delegations of authority name, and they expire.
Monitor and review Clause 6.6
Review dates set by rating, review campaigns, key risk indicators with thresholds, incidents that prompt a reassessment, control tests and nonconformities.
Record and report Clause 6.7
Dashboards and heat maps, roll-ups by business unit, snapshots of exactly what the board saw, the full register as an Excel workbook, and a tamper-evident log of every change.
Bring your spreadsheet with you
Upload your old register as it is. Rosco suggests how its columns and values map to Rosco's fields, shows a dry run with every error and change, and imports only when you commit. The full register exports to a formatted Excel workbook with heat-map sheets and imports back again, so nothing is locked in.
Controls that prove themselves
A control library with design and operating effectiveness, tests and evidence. Map controls to 15 frameworks ready to add, including NIST CSF 2.0, the ASD ISM and Essential Eight, and APRA CPS 234 and CPS 230, or import ISO/IEC 27001 from your own copy. Export a Statement of Applicability.
Ask Rosco, your AI risk manager
Enterprise edition
Rosco sits beside every page. Ask about your register in plain English and it looks things up as you, shows what it read, and links every record it mentions.
- Drafts you apply. Describe a risk and Rosco interviews you, checks for similar risks, and drafts it with ratings from your own criteria. Treatment plans, controls, rewording and acceptance requests arrive as cards that show exactly what would change.
- A coach for quality. Vague events, causes written as consequences, missing controls, overdue reviews and risks above appetite with no treatment are found by plain rules, then explained, with a fix ready to apply.
- Reads your documents. Attach meeting minutes, a project plan or an incident report and choose which of the risks it finds to draft. Attach an old spreadsheet and Rosco maps it for the import.
Safe by design, not by promise
- It sees only what you can see. Every look-up goes through Rosco's own access rules as the person asking. Confidential risks can be kept from the AI entirely.
- It changes nothing itself. Each change is applied by a person, through the same validation, approvals and audit trail as an edit made by hand.
- You choose where the AI runs. Anthropic's Claude API, Claude on AWS Bedrock, or a compatible model server on your own network, such as Ollama or vLLM.
- Tested before every release. 55 scripted conversations, including planted-instruction attacks, against each supported provider; assessed against the OWASP Top 10 for LLM Applications (2026). How Rosco handles AI risk.
Built for the people who run the systems
Rosco is designed to pass a security review, and to be easy to look after once it has.
- Install it your way. Docker Compose with automatic TLS, an air-gapped bundle with checksums, or deb and rpm packages for Ubuntu, Debian and RHEL. The only dependency is PostgreSQL.
- A record that can't be quietly edited. Every change is versioned and written to a hash-chained audit log that you can verify, and forward to your SIEM.
- Identity you already run. SAML 2.0 and OIDC single sign-on with Entra ID, Okta, Google and others, SCIM 2.0 provisioning, and identity-provider groups mapped to roles (Enterprise). Local accounts with two-factor authentication in every edition.
- No phone-home. Licences are signed and checked offline. Images are signed and come with an SBOM; backups restore in one step and check the audit chain.
- Access that holds at the database. Row-level security in PostgreSQL backs every business-unit boundary. System administrators don't see risk content unless they're also given a risk role.
- Easy to run and connect. Prometheus metrics, a Grafana dashboard and OpenTelemetry tracing. A REST API with an OpenAPI description, API tokens and webhooks.
Two editions, one register
Start with the free Community edition, or with Enterprise from day one. Both are the same software: an Enterprise licence switches on the extra features, with no reinstall and no data migration.
| Feature | Community | Enterprise |
|---|---|---|
| The register | ||
| The full ISO 31000 process: context, criteria, bow-tie risks, ratings, controls, treatment, acceptance, KRIs, incidents, nonconformities and reviews | Included | Included |
| Approval workflow; email, Microsoft Teams and Slack notifications | Included | Included |
| Executive dashboard, business-unit roll-up and snapshots | Included | Included |
| Excel export, round-trip import and legacy spreadsheet import | Included | Included |
| Framework library, control mapping and Statement of Applicability | Included | Included |
| Audit log, version history and confidential risks | Included | Included |
| People and access | ||
| Local accounts with two-factor authentication; API tokens | Included | Included |
| Business-unit hierarchy | Included | Included |
| Access limited to a business unit and the units beneath it | Organisation-wide only | Included |
| SAML 2.0 and OIDC single sign-on | — | Included |
| SCIM 2.0 provisioning and group-to-role mapping | — | Included |
| Reporting and AI | ||
| Saved list views | Included | Included |
| Board and committee PDF packs | — | Included |
| Report builder: saved, shared and scheduled reports | — | Included |
| Ask Rosco: questions, drafts, quality coaching, documents and spreadsheets | — | Included |
| Licence and support | ||
| Licence | AGPL-3.0, free | Annual subscription |
| Support | Community forum | Email, with a response time by plan |
Pay for the people who edit
Viewers and Auditors, such as board members, are free. Choose the Enterprise model that fits how your organisation is built.
Australian dollars, excluding GST, billed annually. Per person costs less below 100 people for one entity, plus 50 for each additional entity.
- Per person
- $120 per paid seat, per year
- Unlimited business entities. Minimum 10 people.
- Per business entity
- $12,000 first entity, per year
- $6,000 for each additional entity. 250 people included per entity, pooled; then $40 a person.
Try Enterprise free for 30 days. No card needed.
Install Rosco, upload the trial licence, and every Enterprise feature switches on. When the trial ends, your register keeps working as the Community edition.