digraph ISO27005_Risk_Assessment {
    rankdir=LR;
    splines=curved;
    bgcolor="white";
    fontname="Arial";

    node [
        shape=box,
        style="rounded,filled",
        fontname="Arial",
        fontsize=11
    ];

    edge [
        fontname="Arial",
        fontsize=10
    ];

    ISO27005 [
        label="ISO/IEC 27005\nRisk Assessment",
        shape=oval,
        fillcolor="#6366F1",
        fontcolor="white",
        fontsize=14
    ];

    Context [
        label="1. Context\nEstablishment",
        fillcolor="#E0E7FF"
    ];

    Identification [
        label="2. Risk\nIdentification",
        fillcolor="#DBEAFE"
    ];

    Analysis [
        label="3. Risk\nAnalysis",
        fillcolor="#DCFCE7"
    ];

    Evaluation [
        label="4. Risk\nEvaluation",
        fillcolor="#FEF3C7"
    ];

    Treatment [
        label="5. Risk\nTreatment",
        fillcolor="#FEE2E2"
    ];

    Acceptance [
        label="6. Risk\nAcceptance",
        fillcolor="#F3E8FF"
    ];

    Communication [
        label="7. Risk\nCommunication",
        fillcolor="#ECFEFF"
    ];

    Monitoring [
        label="8. Monitoring\n& Review",
        fillcolor="#F0FDFA"
    ];

    ISO27005 -> Context;
    Context -> Identification;
    Identification -> Analysis;
    Analysis -> Evaluation;
    Evaluation -> Treatment;
    Treatment -> Acceptance;
    Acceptance -> Communication;
    Communication -> Monitoring;

    ContextScope [label="Define Scope & Boundaries", fillcolor="#EEF2FF"];
    ContextAssets [label="Identify Assets", fillcolor="#EEF2FF"];
    ContextCriteria [label="Define Risk Criteria", fillcolor="#EEF2FF"];
    ContextStakeholders [label="Identify Stakeholders", fillcolor="#EEF2FF"];

    Context -> ContextScope;
    Context -> ContextAssets;
    Context -> ContextCriteria;
    Context -> ContextStakeholders;

    IdThreats [label="Identify Threats", fillcolor="#EFF6FF"];
    IdVulnerabilities [label="Identify Vulnerabilities", fillcolor="#EFF6FF"];
    IdEvents [label="Identify Risk Events", fillcolor="#EFF6FF"];
    IdControls [label="Identify Existing Controls", fillcolor="#EFF6FF"];

    Identification -> IdThreats;
    Identification -> IdVulnerabilities;
    Identification -> IdEvents;
    Identification -> IdControls;

    AnalysisLikelihood [label="Assess Likelihood", fillcolor="#ECFDF5"];
    AnalysisImpact [label="Assess Impact", fillcolor="#ECFDF5"];
    AnalysisLevel [label="Determine Risk Level", fillcolor="#ECFDF5"];

    Analysis -> AnalysisLikelihood;
    Analysis -> AnalysisImpact;
    Analysis -> AnalysisLevel;

    EvalCompare [label="Compare with Risk Criteria", fillcolor="#FFFBEB"];
    EvalPrioritize [label="Risk Prioritization", fillcolor="#FFFBEB"];

    Evaluation -> EvalCompare;
    Evaluation -> EvalPrioritize;

    TreatMitigate [label="Risk Mitigation", fillcolor="#FEF2F2"];
    TreatAvoid [label="Risk Avoidance", fillcolor="#FEF2F2"];
    TreatTransfer [label="Risk Transfer / Sharing", fillcolor="#FEF2F2"];
    TreatAccept [label="Risk Retention", fillcolor="#FEF2F2"];

    Treatment -> TreatMitigate;
    Treatment -> TreatAvoid;
    Treatment -> TreatTransfer;
    Treatment -> TreatAccept;

    AcceptDecision [label="Formal Risk Acceptance", fillcolor="#FAF5FF"];
    AcceptApproval [label="Management Approval", fillcolor="#FAF5FF"];

    Acceptance -> AcceptDecision;
    Acceptance -> AcceptApproval;

    CommInternal [label="Internal Communication", fillcolor="#ECFEFF"];
    CommExternal [label="External Communication", fillcolor="#ECFEFF"];
    CommDocs [label="Risk Documentation", fillcolor="#ECFEFF"];

    Communication -> CommInternal;
    Communication -> CommExternal;
    Communication -> CommDocs;

    MonitorReview [label="Periodic Review", fillcolor="#F0FDFA"];
    MonitorChanges [label="Monitor Changes", fillcolor="#F0FDFA"];
    MonitorImprove [label="Continuous Improvement", fillcolor="#F0FDFA"];

    Monitoring -> MonitorReview;
    Monitoring -> MonitorChanges;
    Monitoring -> MonitorImprove;
}