Risk Register
Living risk register + heat map
Cara menggunakan: The living doc. Residual scores require the risk OWNER's acceptance, not the security team's.
Pratinjau
Risk Register
The living risk document – ISO 31000 process + 27001 cl.8.2/8.3 output. One row per identified risk; review quarterly minimum.
| Field | Value |
|---|---|
| Period | YYYY cycle |
| Methodology | DOC-ISMS-010 |
| Owner | Risk committee / CISO |
Register
| ID | Asset / scope | Risk description | L | I | Score | Level | Treatment | Control (Annex A) | Owner | Residual | Status |
|---|---|---|---|---|---|---|---|---|---|---|---|
| R-001 | Customer DB | Unauthorized access to personal data | 3 | 4 | 12 | High | Mitigate | A.8.3 access control | @name | 4 | Treating |
| R-002 | Office | Loss of premises access | 2 | 3 | 6 | Med | Transfer | insurance | @name | 3 | Accepted |
| R-003 | Laptop fleet | Lost device data exposure | 3 | 4 | 12 | High | Mitigate | A.8.1 encryption | @name | 4 | Treating |
| R-004 | SaaS vendor | Vendor outage affects availability | 3 | 3 | 9 | Med | Mitigate | A.5.22 supplier | @name | 6 | Monitor |
| R-005 | – | – |
Summary statistics
| Level | Count | Target |
|---|---|---|
| Critical/High | N | trending down |
| Medium | N | – |
| Low/accepted | N | – |
Heat map (L x I)
| I\L | 1 | 2 | 3 | 4 | 5 |
|---|---|---|---|---|---|
| 5 | |||||
| 4 | R-001 | R-003 | |||
| 3 | R-004 | ||||
| 2 | |||||
| 1 |
Review log
| Date | Change | By |
|---|---|---|
| YYYY-MM-DD | R-001 added | @name |