Cybersecurity risk register: every finding, one ranked list
A cybersecurity risk register lists each known security risk with its severity, owner, treatment and status. This one consolidates the findings you have already produced in PlayCISO's other security-architect tools — the Threat Model, Architecture Studio and Design Review Workbench — into a single, severity-ranked list with owner and status tracking, then exports it in board-ready and machine-readable formats. It is an aggregator of your PlayCISO work, not a scanner of your live environment.
Risk register template and example
A risk register is one list of the risks you know about, each with a score, an owner and a decision. Copy these columns into a spreadsheet to start. Likelihood and impact are 1 (low) to 5 (high); score = likelihood × impact.
| ID | Risk | L | I | Score | Owner | Treatment | Controls | Residual | Status | Review |
|---|---|---|---|---|---|---|---|---|---|---|
| R-01 | Ransomware encrypts file servers and backups reachable from the domain | 3 | 5 | 15 | Head of IT | Mitigate | Immutable offline backups, EDR, restore test each quarter | 6 | In progress | Monthly |
| R-02 | Admin account taken over through MFA fatigue or a stolen session | 3 | 4 | 12 | Identity lead | Mitigate | Phishing-resistant MFA for admins, session revocation runbook | 4 | Open | Monthly |
| R-03 | Payroll SaaS supplier breach exposes employee data | 2 | 4 | 8 | HR director | Transfer | Contract breach clause, cyber insurance, supplier review | 6 | Accepted | Quarterly |
| R-04 | Invoice fraud: supplier bank details changed by email | 3 | 3 | 9 | Finance lead | Mitigate | Call-back verification on any bank change | 3 | Closed | Quarterly |
| R-05 | Legacy file transfer server past end of support | 2 | 3 | 6 | Infra manager | Avoid | Migrate and decommission by Q2 | 2 | In progress | Quarterly |
Example entries are illustrative, not benchmarks. Treatment options: mitigate (reduce), transfer (insurance or contract), accept (with a named approver) or avoid (stop the activity). To put a money figure on a risk, use the annual loss expectancy method.
What it does
One view across three tools
Pulls findings from your Threat Model, Architecture Studio and Design Review Workbench into a single ranked list, tagged by source.
Severity, residual & ownership
Each row carries a severity band, a normalised score, residual risk where set, owner and status — sorted worst-first.
Board-ready & machine-readable export
Export to CSV, SARIF, OSCAL, Open Threat Model, OWASP Threat Dragon, or a printable report.
How it works
- 1Use the Threat Model, Architecture Studio or Design Review Workbench to produce findings.
- 2Open the Risk Register — it reads what those tools saved in your browser and merges everything into one ranked list.
- 3Filter by source, set residual risk, owners and status, and see the critical/high/medium/low counts.
- 4Export to CSV, SARIF, OSCAL, OTM or Threat Dragon, or print the summary report for a board pack.
Honest about what this is
- A consolidation and export layer over the risk work you do in PlayCISO's other tools.
- Turns scattered threat-model, architecture and design-review findings into one board-ready register.
- ✕ Not a vulnerability scanner — it starts empty until you have findings from the other tools, and reads nothing from your live systems.
FAQ
What is a cybersecurity risk register?
A cybersecurity risk register is one list of the security risks an organisation knows about, each with a description, a severity or score, an owner, the treatment decision (mitigate, accept, transfer or avoid), its status and a review date. It is how risk stops living in scattered reports and becomes something a person is accountable for.
What does a risk register example look like?
One example entry: "Customer API returns other customers' orders when the order ID is changed (broken object-level authorisation)". Source: design review. Severity: high. Likelihood: likely; impact: major. Owner: payments engineering lead. Treatment: mitigate with an ownership check on every order lookup. Status: in progress. Residual risk after the fix: low. Review: next quarter. This register produces entries in that shape from your studio findings and exports them as CSV, SARIF or OSCAL.
Where do the risks come from?
From the other PlayCISO security-architect tools you have already used in the same browser — the Threat Model, Architecture Studio and Design Review Workbench. The Risk Register reads what those tools saved locally and consolidates it into one view. It does not scan your environment or import anything from outside PlayCISO.
What if I have not used those tools yet?
Then the register starts empty. It is an aggregator, so you build a threat model, run an architecture review or a design review first, and their findings then appear here ranked together.
What does it show for each risk?
Its source tool, a severity band (critical / high / medium / low), a normalised score, residual risk where you set one, the owner and the status, plus references like CWE, ASVS or framework control IDs.
What can I export?
CSV, SARIF, OSCAL, Open Threat Model (OTM), an OWASP Threat Dragon file, and a printable summary report.
Is it free?
A free account gets 3 runs in total, shared across PlayCISO's metered tools, and the register is one of them. After that it needs a paid plan, which also covers exports. The template and example on this page are free to read and copy.
How often should a risk register be updated?
Whenever something changes the risk: a new system, an incident, an audit finding, a supplier change. On top of that, review each risk on a fixed cycle, typically monthly for high risks and quarterly for the rest, and show the review date in the register so stale entries are obvious.
What is the difference between a risk register and a risk assessment?
A risk assessment is the activity of finding and scoring risks for a scope at a point in time. The risk register is the living list where the results are kept, with owners, treatment decisions and status, and updated as things change.
What columns should a risk register have?
At minimum: an ID, a description of the risk, likelihood, impact, an inherent score, the owner, the treatment (mitigate, transfer, accept or avoid), the planned controls, the residual score, status and next review date. The example table on this page shows them filled in.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.