The Risk Register tracks information security risks identified through the IA risk assessment process.

Risk Assessment

Each risk is evaluated using likelihood (1-5) and impact (1-5) scales. The risk level is calculated as:

  • Low — Score 1-4
  • Medium — Score 5-9
  • High — Score 10-15
  • Critical — Score 16-25

Treatment Options

  • Mitigate — Implement controls to reduce likelihood or impact
  • Accept — Accept the risk within defined appetite
  • Transfer — Transfer risk through insurance or outsourcing
  • Avoid — Eliminate the risk by removing the activity

Residual risk is reassessed after treatment controls are implemented.