Risk Register template: The register of a system's or an organization's identified risks, their assessed level, the response decided and who owns it, based on the cybersecurity risk register in NIST IR 8286 Rev. 1.
The register of a system’s or an organization’s identified risks, their assessed level, the response decided and who owns it, based on the cybersecurity risk register in NIST IR 8286 Rev. 1.
Add each risk identified in a risk assessment, and each risk raised by an assessment, monitoring, an audit or an incident (RA-3).
Rate likelihood, impact and exposure with the scales in the organization’s risk management strategy, so risks can be compared across systems.
Record the response decided for each risk, in line with the organization’s risk tolerance (RA-7).
Record who accepted a risk, when, and when the acceptance expires. Only an official the risk management strategy authorizes for that risk level may accept it.
Review open risks Fill in: for example quarterly, and keep closed risks with their closure date.
Field
What to record
ID
A unique, permanent identifier for the risk
Priority
The risk’s rank relative to the others in the register
Risk description
The threat, the vulnerability or condition it exploits, and the harm that could result
Risk category
The organization’s category, for example operational, privacy, supply chain or compliance
Affected system and components
Where the risk applies
Related controls
The controls whose weakness or absence creates the risk, such as AC-2 or SI-2
Likelihood
The current likelihood, on the organization’s scale
Impact
The current impact, on the organization’s scale
Exposure rating
The resulting risk level
Response type
Accept, avoid, mitigate, share or transfer
Response description
What will be done, and the plan of action and milestones item, if any
Response cost
The estimated cost of the response
Risk owner
The role accountable for the risk and its response
Acceptance
For an accepted risk: who accepted it, the date, the compensating measures and the expiry date
Status
Open, in progress, accepted or closed
Date identified and source
When and how the risk was found, for example the risk assessment report reference
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.