Cybersecurity glossary
What is risk register?
Definition
A risk register is a maintained list of risks with their likelihood, impact, owner, controls, treatment plan and review date.
Why it matters
It is the working record of a risk program, reviewed regularly and updated after changes and incidents. Auditors for ISO 27001 and SOC 2 commonly ask to see how risks are tracked.
Common questions about risk register
See also
Sources
Related Guides
GuideGRC
How to Conduct a Cybersecurity Risk Assessment in 7 Steps
A step-by-step method for information security risk assessment aligned with ISO 27005 and NIST SP 800-30: assets, threats, likelihood and impact scoring, risk appetite, treatment and the risk register.
Read more GuideAI Security
10 LLM Security Risks Every Team Should Understand
Examine the top 10 LLM security risks affecting modern applications and learn concrete defensive controls to safeguard your data, models, and infrastructure.
Read more GuideGRC
10 Steps to Implement ISO 27001 and Get Certified
A step-by-step ISO/IEC 27001:2022 implementation plan: scope, leadership, risk assessment, Statement of Applicability, Annex A controls, internal audit, management review and the certification audit.
Read more GuideGRC
How to Do a DPIA: A Step-by-Step Security and Privacy Guide
Learn how to do a DPIA step by step. Identify privacy risks, assess necessity and proportionality, and implement controls to protect personal data.
Read more