What is a risk register?
Short answer
A risk register is a living list of identified risks, each with a description, likelihood, impact, owner, current controls, planned treatment and review date. It turns a one-time risk assessment into an ongoing management tool.
The details
A spreadsheet is fine to start. Review it on a schedule, for example quarterly, and whenever something major changes, such as a new system, supplier or incident.
Useful next reads and tools
- Cyber Risk Register · tool
Terms explained
- Risk register
- A risk register is a maintained list of risks with their likelihood, impact, owner, controls, treatment plan and review date.
- Risk assessment
- A cybersecurity risk assessment identifies assets, threats and weaknesses, estimates likelihood and impact, and prioritizes how to treat each risk.
Sources
Related questions
Related Guides
GuideGRC
How to Conduct a Cybersecurity Risk Assessment in 7 Steps
A step-by-step method for information security risk assessment aligned with ISO 27005 and NIST SP 800-30: assets, threats, likelihood and impact scoring, risk appetite, treatment and the risk register.
Read more GuideGRC
10 Steps to Implement ISO 27001 and Get Certified
A step-by-step ISO/IEC 27001:2022 implementation plan: scope, leadership, risk assessment, Statement of Applicability, Annex A controls, internal audit, management review and the certification audit.
Read more GuideGRC
How to Do a DPIA: A Step-by-Step Security and Privacy Guide
Learn how to do a DPIA step by step. Identify privacy risks, assess necessity and proportionality, and implement controls to protect personal data.
Read more GuideGRC
8 AI Vendor Risk Assessment Questions for Your Business
Review these 8 essential AI vendor risk assessment questions before adopting third-party artificial intelligence tools to protect your business data.
Read more