Lesson 1.8: Running a risk register
Intro 101 defined risk as likelihood times impact. Running security means doing that for dozens of risks at once, every quarter, and deciding what happens to each: mitigate, transfer, avoid or accept, with an owner and a date. That's a risk register, the core of ISO/IEC 27005 and NIST's risk management guidance. In the lab you read Northwind's register, score and rank every risk, count how many are high, find the high risks nobody has decided anything about, and record the decisions.
15 min
You will learn to
- Read a risk register
- Score and rank risks
- Group risks into bands
- Find high risks without treatment
- Record risk decisions with owner and date
Key terms
- Risk register
- The list of identified risks with their score, owner, treatment and status.
- Risk treatment
- Mitigate (reduce), transfer (insurance, contract), avoid (stop the activity) or accept.
- Risk owner
- The person accountable for a risk and for deciding its treatment.
- Risk appetite
- How much risk the organisation is willing to take to reach its goals.
- Residual risk
- The risk that remains after treatment.
← What is cybersecurity? Confidentiality, integrity, availability · All lessons · Zero trust in practice →