Skip to content
Free template · copy-ready

Board Cyber Risk Register (Quantified)

Boards decide in money and consequences, not CVSS scores or heatmap colours. This register translates your top cyber risks into defensible loss ranges — built on a FAIR-lite frame (loss event frequency × loss magnitude) — sets each against the appetite the board stated, and pairs it with the treatment and its cost so the board can actually decide.

Educational template — not professional risk advice. Every dollar figure below is an illustrative placeholder; replace them with your own quantified estimates and adapt this to your risk framework.

Free · no signup · adapt it in your own doc

Board Cyber Risk Register (Quantified)

A board-ready view of the top cyber risks, each translated into a defensible financial loss range and set against the board’s stated risk appetite. Built on a FAIR-lite frame — risk = loss event frequency × loss magnitude. All dollar figures below are ILLUSTRATIVE placeholders; replace them with your own quantified estimates.

01How to read this register (method note)

This register reports risk the way a board can act on it: in money and consequences, not in CVSS scores or heatmap colours. Each risk is quantified with a FAIR-lite model — how often the loss event is expected (loss event frequency) multiplied by what it costs when it happens (loss magnitude) — and shown as a calibrated range rather than a single false-precise number.

  • Loss is expressed as a RANGE (minimum–most likely–maximum annualized), reflecting real uncertainty — not a single figure like $4,237,812 that implies false precision.
  • Figures are decided on RESIDUAL risk (after the controls you actually run), with inherent risk noted only to show the value those controls deliver.
  • Each risk carries an APPETITE STATUS — over or under the loss the board has said it will tolerate — so the board sees at a glance what is outside tolerance.
  • Round every figure to the precision your inputs justify. A maturity score is a capability metric, not a risk number, and does not belong in the loss columns.
Illustrative template — all dollar amounts, frequencies and statuses shown as placeholders are examples. Pair this register with a FAIR ALE model (e.g. a FAIR ALE calculator or quantification spreadsheet) to generate the ranges, then record the results here.

02Top quantified risks

The most significant cyber risks, each as a loss event frequency, an annualized loss range, the current treatment, an owner, and status against appetite. Keep the list short — the risks that need board attention, not every line in the operational register.

Risk scenarioLoss event frequencyLoss magnitude (min–likely–max, annualized)Current treatmentOwnerAppetite status
Ransomware encrypts a revenue-generating platform~0.3×/yr (once every ~3 yrs)$2M – $6M – $15MEDR + tested offline backupsCISOOVER appetite
Customer PII exfiltration via web app~0.5×/yr$1M – $4M – $9MWAF + quarterly pentestHead of AppSecOVER appetite
Business email compromise / wire fraud~1×/yr$0.1M – $0.5M – $2MPayment call-back control + trainingCFO / FinanceUNDER appetite
Critical SaaS vendor outage or breach~0.4×/yr$0.5M – $2M – $6MVendor DR review + contractual SLAsHead of Vendor RiskAT appetite
Insider misuse of privileged access~0.2×/yr$0.3M – $1M – $4MPAM + access reviewsIAM LeadUNDER appetite
Loss magnitude should include both primary loss (your direct response: IR, forensics, downtime) and secondary loss (fines, legal, customer churn, reputational harm) — the secondary losses often dominate.

03Assumptions & data sources

Quantification is only as defensible as its inputs. Record where each estimate came from and how confident you are, so a challenge in the board room is answered from the page rather than improvised.

Frequency sources
Incident history, industry base rates / reference classes, threat intel, calibrated expert estimates
Loss magnitude sources
Response-cost actuals, breach-cost studies, legal/regulatory exposure estimates, revenue-per-hour for downtime
Estimation method
Calibrated 90% confidence intervals; ranges simulated into a loss distribution where used
Confidence & known gaps
Flag low-confidence scenarios (e.g. novel AI-vendor risk with little loss data) and what would improve them
Risk appetite reference
The board-stated tolerance this register is measured against, e.g. up to $5M annualized cyber loss across the portfolio
Where data is genuinely thin, present a wide, explicitly low-confidence range (or a reasoned qualitative rating) with the assumptions stated — not an invented precise figure, and not a silent omission.

04Recommended treatments & cost

A risk without an option is an alarm, not a decision. For each risk the board must act on, give the recommended treatment, what it costs, and the residual risk once it is in place — so the board can weigh the spend against the loss avoided.

RiskRecommended treatment optionOne-off / annual costResidual risk after treatmentDecision requested
Ransomware on revenue platformImmutable backups + segmentation + IR retainer$250k one-off + $120k/yr$0.5M – $1.5M – $4MApprove spend
Customer PII exfiltrationDLP + bug-bounty + schema hardening$180k/yr$0.4M – $1M – $3MApprove / defer
Critical SaaS vendor breachAdd contractual breach terms + warm standby$90k/yr$0.3M – $1M – $3MAccept residual
Residual figures here are ILLUSTRATIVE. The point for the board is the comparison: cost of treatment versus reduction in the loss range.

05What we’re escalating vs reporting

Separate the risks that need a board decision from those shown for awareness. Escalate what breaches appetite or is trending sharply worse; report the rest.

Escalating (decision required)
Risks over appetite or deteriorating fast — each with the treatment, cost and decision requested from the tables above
Reporting (awareness only)
Risks within appetite and stable — monitored, no board action needed this cycle
Trend since last report
Which risks moved up/down, and why — new findings, completed treatments, changed exposure
Appetite review flag
Note if the pattern suggests the stated appetite itself should be revisited
  • Do not flood the board with every line in the operational register — that buries the risks that matter.
  • Report risk in loss terms against appetite; use a maturity or capability score, if shown at all, as a complementary metric, never as the risk number.

Practice the decision

This register records calls you can rehearse. The free Risk-to-Dollars Translation Lab puts you in the risk lead’s seat in front of a skeptical board and grades you on the exact decisions this register captures — translating a finding into dollars, giving a calibrated range over false precision, deciding on residual risk, tying each risk to appetite, and knowing what to escalate.

TL;DR

What this template is

  • A board-ready cyber risk register that reports each top risk as a defensible financial loss range set against the board’s stated risk appetite — built on a FAIR-lite frame (loss event frequency × loss magnitude).
  • Sections: how to read it (method note), top quantified risks, assumptions & data sources, recommended treatments & cost, and what to escalate versus simply report.
  • All dollar figures are illustrative placeholders — copy it or download it as Markdown and replace them with your own quantified estimates. Nothing is uploaded.
  • Pair it with a FAIR ALE model to generate the ranges, and practise presenting them in the free Risk-to-Dollars Translation Lab.
  • Educational template — not professional risk advice. Adapt it to your own risk framework and data.

Frequently asked questions

What is this template for?

It is a board-ready cyber risk register that translates your top technical risks into financial terms a board can act on. Each risk is shown as a loss event frequency, a calibrated annualized loss range (minimum–most likely–maximum), the current treatment, an owner, and its status against the board’s risk appetite — plus recommended treatments with costs and what you are escalating versus reporting.

Why loss ranges instead of a single dollar figure?

Cyber loss is uncertain, so a single precise number (especially one like $4,237,812 built on rough assumptions) implies a confidence the data does not support and falls apart the moment an assumption is challenged. A calibrated range — for example a 10th-to-90th-percentile band with the most-likely value marked — communicates both the estimate and its uncertainty honestly, and rounds to the precision the inputs justify.

How does this relate to FAIR and ALE?

The register uses a FAIR-lite structure: risk = loss event frequency × loss magnitude, where magnitude includes primary loss (direct response) and secondary loss (fines, legal, churn, reputation). You can generate the ranges with a FAIR ALE model or quantification spreadsheet (ALE = SLE × ARO) and then record the quantified results in this register for the board.

Is this professional risk advice?

No. It is an educational template and every figure in it is an illustrative placeholder. Apply the structure to your own context, data and risk framework, and confirm board-reporting and appetite decisions with your risk and governance functions.

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout
Board Cyber Risk Register (Quantified) Template — Free & Copy-Ready · PlayCISO