Why Most Risk Registers Fail
Most cybersecurity risk registers end up as abandoned, multi-tab spreadsheets with 400 theoretical threats that no developer or executive ever reads.
Under ISO/IEC 27001 Clause 6.1.2 and SOC 2 CC3 (Risk Assessment), external auditors are not looking for sheer volume. They want to see:
- A clear, documented scoring criteria (Likelihood × Impact).
- Assigned individual owners for each risk.
- Realistic treatment decisions (Mitigate, Accept, Transfer, Avoid).
- Evidence that leadership reviews the register on a regular cadence (at least annually or post-incident).
The Standard 5x5 Scoring Rubric
Likelihood (1 – 5)
- 1 (Rare): Highly sophisticated state-sponsored capability required; no known history.
- 2 (Unlikely): Requires significant access or insider collusion.
- 3 (Possible): Known vulnerability with public proof-of-concept exploits.
- 4 (Likely): Frequent automated attacks (e.g. opportunistic phishing, port scanning).
- 5 (Almost Certain): Ongoing daily attempts against unpatched external assets.
Impact (1 – 5)
- 1 (Insignificant): Minor internal inconvenience; no data loss or public notice.
- 2 (Minor): Localized outage under 1 hour; no regulatory reporting required.
- 3 (Moderate): Substantial business disruption; confidential internal documents exposed.
- 4 (Major): Widespread customer data breach; contractual SLA penalties; regulatory notification.
- 5 (Catastrophic): Complete service outage; massive fine (e.g. GDPR 4% turnover); existential reputation loss.
Risk Score Calculation
$$\text{Inherent Risk} = \text{Likelihood} \times \text{Impact}$$
- 1 – 6 (Low): Acceptable within normal risk appetite.
- 8 – 12 (Medium): Implement standard operational controls within 90 days.
- 15 – 25 (High / Critical): Requires immediate executive remediation and board escalation.
Core Template Columns
When setting up your register, maintain these 10 core fields:
- Risk ID: Unique identifier (e.g.
RSK-SEC-001). - Category: Governance, Infrastructure, Application, Supply Chain, People.
- Risk Description: Plain-language scenario ("If X happens due to Y, it will result in Z").
- Asset Impacted: Database, AWS Account, Identity Provider, Customer PII.
- Inherent Score: Likelihood (1-5) × Impact (1-5).
- Existing Controls: Controls currently in production (e.g. MFA, WAF, daily backups).
- Residual Score: Re-calculated score reflecting existing safeguards.
- Treatment Plan: Mitigate, Accept, Transfer (cyber insurance), or Avoid.
- Action & Due Date: Specific engineering or operational task with a completion deadline.
- Risk Owner: Named individual accountable for execution (e.g. Lead Cloud Architect).