# Risk Register

> The living risk document – ISO 31000 process + 27001 cl.8.2/8.3
> output. One row per identified risk; review quarterly minimum.

| Field | Value |
|-------|-------|
| Period | YYYY cycle |
| Methodology | DOC-ISMS-010 |
| Owner | Risk committee / CISO |

## Register

| ID | Asset / scope | Risk description | L | I | Score | Level | Treatment | Control (Annex A) | Owner | Residual | Status |
|----|---------------|------------------|---|---|-------|-------|-----------|-------------------|-------|----------|--------|
| R-001 | Customer DB | Unauthorized access to personal data | 3 | 4 | 12 | High | Mitigate | A.8.3 access control | @name | 4 | Treating |
| R-002 | Office | Loss of premises access | 2 | 3 | 6 | Med | Transfer | insurance | @name | 3 | Accepted |
| R-003 | Laptop fleet | Lost device data exposure | 3 | 4 | 12 | High | Mitigate | A.8.1 encryption | @name | 4 | Treating |
| R-004 | SaaS vendor | Vendor outage affects availability | 3 | 3 | 9 | Med | Mitigate | A.5.22 supplier | @name | 6 | Monitor |
| R-005 | – | – | | | | | | | | | |

## Summary statistics

| Level | Count | Target |
|-------|-------|--------|
| Critical/High | N | trending down |
| Medium | N | – |
| Low/accepted | N | – |

## Heat map (L x I)

| I\L | 1 | 2 | 3 | 4 | 5 |
|-----|---|---|---|---|---|
| 5 | | | | | |
| 4 | | | R-001 | R-003 | |
| 3 | | | R-004 | | |
| 2 | | | | | |
| 1 | | | | | |

## Review log

| Date | Change | By |
|------|--------|-----|
| YYYY-MM-DD | R-001 added | @name |