Best Guide to Building a Risk Register (Plus Examples & Template)

"As cybersecurity leaders, we have to create our message of influence because security is a culture, and you need the business to take place and be part of that security culture." 

Britney Hommerzheim - Global Business Information Security Officer at Cardinal Health

‍

One single vulnerability. 

That's all a cybercriminal needs to infiltrate your networks and systems, disrupt your operations, and bankrupt your company.

A data breach costs an Australian business $3.35 million on average, and 60% of data breaches are directed at small Aussie companies.

If not planned for in advance, disasters or emergencies can destroy your business or damage it enough to leave you scathed for the foreseeable future.

Still, many companies struggle to grasp the magnitude of the damage a cyberattack can have on their business. Others just don't know how to incorporate cybersecurity risk into their overall risk management process.

And that's precisely why the NIST (National Institute of Standards and Technology) released a report titled "Integrating Cybersecurity and Enterprise Risk Management (ERM)." In this report, the NSIT emphasises the importance for businesses to use a risk register.

Having a risk register will make it easier for your organisation to identify, assess and monitor risks and develop mitigation plans. 

And this, in turn, means that you'll be more likely to be able to prevent disasters and be better equipped to deal with them swiftly and efficiently if they occur.

But what is a risk register? And how do you build one?

This is exactly what this article answers.

‍

What Is A Risk Register?

‍

A risk register is a document companies and organisations use to record their identified potential risks. They also use it to document the probability of a risk occurring, the consequences it would have on the business, and all the mitigation strategies that should be implemented to reduce this risk. Its simple and easy-to-understand format allows everybody on your team to understand the kind of risks the business is exposed to and who is responsible for managing these risks.

A risk register is a key element of a successful risk management plan. It allows you to store all of your information in the same place and helps you create and adjust your risk management process and the mitigation strategies your business should take in case of disaster or emergency. 

And as mentioned before, a risk register should also clearly assign responsibilities when managing identified risks.

‍

Why Is A Risk Register Important?

‍

Regardless of the nature of your business and the industry you operate in, your organisation faces risks every day. 

From reputational, legal, and financial risks due to employees' negligence to cybersecurity and supply chain risks, it can be difficult to monitor all of the risks you're facing and understand their impact and the likelihood of them becoming a reality without using a document to help you track this vital information. 

A risk register is a key element to provide your management team with a bigger picture of your exposure to risks and help them understand each of them. It's a powerful tool to help leadership manage these risks and implement the best mitigation strategies to prevent them from happening.

More specifically, here are some of the main benefits of a cyber risk register:

• Provides central visibility of a wide spectrum of cyber threats and their potential impact on your company
• Ensures risk ownership is maintained despite resignations, promotions, and other staff-related changes
• Helps you identify patterns resulting from threats negatively impacting your business
• Helps management understand and prioritize risks and be confident in their risk response strategies
• Allows your company to prove compliance as some standards, such as ISO 27001, require effective risk identification and implementation of a treatment plan 
• Might prove helpful for hearings in the event of a major incident

‍

How Do You Identify Risks?

While it can be tempting to see cybersecurity risks everywhere, adopting a risk-averse mindset could hinder the growth of your business. That's why NIST recommends adding any source of uncertainty, may they be positive (new opportunities) or negative (threats), to your risk register.

For instance, you might be rolling out new digital tools to help you connect with clients from all around the world. And while growing your digital footprint can increase your exposure to cyber risks, it's necessary to help you expand your business and boost your bottom line.

The only difference between listing risks and opportunities in your risk register is the risk response column. 

According to NIST, for cyber opportunities, this column should include one of the following responses:

• Realise: Realise means that the uncertainty should be eliminated to ensure your organisation successfully seizes the opportunity. 
• Share: Delegate to a third party better equipped to capture the opportunity.
• Enhance: Increase the likelihood the opportunity is actualised. 
• Accept: If an opportunity arises, take advantage of it.

And when it comes to threats, each cybersecurity risk added to your risk register should contain the elements below:

• Cybersecurity risk description
• Cybersecurity risk category
• Cybersecurity risk level
• The potential impact of the cybersecurity risk on the business
• Cybersecurity risk probability
• Cybersecurity risk analysis
• Mitigation plan 
• Cybersecurity risk owner
• Risk status

More on this in the following section!

‍

How To Build A Risk Register?

‍

There isn't a one-size-fits-all when it comes to creating a cyber risk register. Every business has its own industry and organisational challenges and, therefore, different needs. Yet, every risk register should include the general elements listed below:

• A Description Of The Risk

Your risk register should highlight a list of risks and describe each of them. For instance, "data loss" or "ransomware." You should always add any supporting history or context to help the team better assess the risk. Another good practice is to add the date you think the event is most likely to happen. Also, don't forget to write down whether you think it could be a recurrent event.

• The Risk Category

This is where you assess whether the risk is reputational, regulatory, financial, operational, or all of the above. Try to be as precise as possible by highlighting the exact subcategory, such as accounting for financial or logistics for operational. This will allow you to prioritise risks and design your risk management plan accordingly. And it will make it easier for stakeholders to assess the risks down the road.

• Risk Level

This section provides another key metric to help you prioritise risks. Is the risk high, medium, or low? Low-priority risks are the ones that have little to no impact on your business, while (you guessed it) high-priority risks can have dire consequences for your company. 

• Potential Impact

If the risk materialises, will the impact be operational, reputational, or financial?

• Risk Probability

What's the likelihood of the risk materialising? Likely? Somewhat likely? Not likely at all? This step is very important and shouldn't be based on your intuition alone. You should do diligent research and discuss with all the necessary parties before rating the level of risk probability.  

• Cybersecurity Risk Analysis

In this section, you should analyse the impact of the cybersecurity risk on your objectives, projects, customers, suppliers, clients, and organisation and what steps will be required to mitigate the damage. Make sure to take into consideration the cost of different levels of damage.

• Mitigation Plan

This is where you want to highlight the key steps the business implemented to prevent the risk from becoming a reality and the actions that will be taken to address it if the risk occurs. Consider all the scenarios possible and list important steps to prevent or address risk for each. This can be a tedious process and might require you to involve more people to help you cover all of your bases. Also, separating your mitigation and contingency plans can be a good idea. The mitigation column of your risk register would only list all possible scenarios and steps to take to prevent the risk from occurring. The contingency plan column would highlight steps to be taken if the risk were to actualise. 

• Cybersecurity Risk Owner: 

Your risk register should highlight who is responsible for addressing and managing the risk. This is key as it will allow your team members to know exactly what they must do if the risk occurs and resolve the situation effectively. If a risk materialises, your team will be working under pressure, which can lead to poor incident response. Allocating ownership will ensure a more focused and effective response.

• Risk Status

This will help you monitor issues. For instance, an open status means that the risk has been identified and captured, while a closed status means that the risk has been addressed and stakeholders have been informed.

Note that the more (relevant) people you can get involved in helping you create the risk register, the better. Identifying and assessing all of the risks across departments and teams is extremely challenging. Having other team members help assess risks and suggest mitigation strategies will ensure your risk management plan hinges on solid foundations! So, make your risk register a collaborative tool updated in real-time based on changes, new learnings, and experiences.

‍

Cybersecurity Risk Response Types

‍

According to NIST, there are four risk response types:

• Accepting

If the probability of the risk materialising is low and a strong mitigation plan has been implemented, accept the cybersecurity risk (within risk tolerance levels). At this stage, you don't need to take or implement any additional risk response steps or actions. However, you should monitor on a regular basis and allocate funds to deal with the risk should it materialise.

• Transferring 

If an identified cybersecurity risk falls outside of risk tolerance levels, you can reduce the risk level by transferring the impact of the risk to a third party and sharing ownership. While this is not always possible (for instance, you can't transfer loss of customer trust), it is effective in instances like cyber security insurance. The financial risk is transferred from you to an insurance company.

• Mitigating

Mitigating is all about reducing cybersecurity risks to an acceptable level. It includes steps to prevent or minimise the operational impact and costs if an incident happens. For instance, you might want to store your critical information across different servers. This way, if you experience a successful cyberattack on one of your servers, you can still access this precious data. 

• Avoiding

Avoiding refers to taking carefully planned steps to prevent the risk from materialising. In some instances, the cost of mitigating and reducing cybersecurity risk is too high and offsets the benefits of a business opportunity. That's why it's important to assess the positive impact of opportunities versus cyber risk before implementing new online services or taking initiatives that could increase your exposure to cyber risk.

‍

Risk Register Best Practices 

As discussed, creating a risk register is critical. But maintaining it and learning from it on an ongoing basis is as important!

Here are some best practices to follow:

• Keep Your Risk Register To A Minimum 

What we mean by that is that your risk register should be clean and easy to read. And for that to happen, you need to ensure you close issues when they're solved and archive them.

• Continuous Monitoring Is Critical 

Once you've added a list of opportunities and risks to your risk register, don't just file it and forget about it. Make sure to regularly update it with new context or information as they arise. Update the risk status regularly to keep the document relevant. In such a rapidly changing cyber landscape, new vulnerabilities and risks can always arise, so it's important to keep monitoring and assessing threats.

The latest NIST guidance on monitoring your risk register provides some clear pointers for companies to follow:

• Set Up Positive KPIs

For instance, list the number of business systems that are vital to your company and have strong authentication protections.

• Set Up Negative KPIs

This could include things such as the number of phishing emails received by employees over the last 90 days or the number of severe business disruptions that have occurred recently.

• Training Your Employees On An Ongoing Basis

This will help them familiarise themselves with the types of cybersecurity risks they could face and understand what steps they should take if they are exposed to one of them. And make sure to review risk management plans and procedures with them regularly. The cybersecurity landscape is constantly changing, and cybercriminals are using increasingly sophisticated techniques. 

• Establishing Clear Communication Channels

Clear communication channels and platforms will allow employees to immediately inform key staff regarding cybersecurity risk issues before they escalate into bigger problems.

• Carry out risk response exercises

Regularly conducting risk response exercises enables you to train employees so they can easily identify, report, and respond to cybersecurity issues or incidents. 

• Always Hold A Post-Incident Meeting

Once the risk has been resolved, and the pressure has gone down, always organise a team meeting to analyse successes and failures. There's something to be learned from every failure. So, make sure to review your risk register to see whether the risk has been identified correctly. You should also assess the incident response strategy and the steps that were taken in detail to see what you could do better if something like this ever happens again. 

As bad as a cyber incident can be for your company, if it does happen, you should at least take the opportunity to learn from it so you can prevent another incident from occurring.

‍

Risk Register Templates

‍

Looking for a risk register example?

Here's a risk register example we created to provide you with some inspiration. 

‍

Risk ID: 1287 (this sequential numeric identifier will allow you to easily identify risk types in your register)

Risk description: Malicious human interference/distributed denial-of-service (DDoS) attack

Risk category: Reputational, financial, and operational
Risk level: The firewall is configured properly and has excellent DDoS mitigation. However, it requires constant monitoring. The risk level is moderate. We estimate the financial loss to be $7000 per hour of downtime.

Impact: The website will be unavailable, meaning we won't be able to take new orders and perform some essential customer service tasks such as inventory checks or order tracking.
Risk probability: Somewhat likely (in addition to collecting relevant parties' feedback, you can also use frameworks such as ISO 31000 and NIST SP 800-300 to assess risk probability).

Mitigation plan: Monitor the firewall. Back up order and customer information on a separate device and network.

Contingent actions: If the risk was to materialise, immediately proceed to DNS redirection to persistently reroute all traffic through the protectors' network. Identify vulnerabilities and tend to them.‍

Owner/Owners: Project Managers‍

Status: Open and requires ongoing monitoring 

To make it easier for you to create your cyber risk register from scratch or update your existing one, we've done some groundwork and found some great templates you can use.

Here's a risk register template from the Victorian government. The example pertains to disasters like power outages, but you can easily tweak it so that it works for cybersecurity risks. And here's another free template developed by Resilient Community Organisations. 

Invest In Cyber Insurance

As mentioned before, part of a successful mitigation plan is the transfer of specific risks to a third party. The right cyber insurance policy can significantly help reduce and mitigate cyber risks for your company.

Cybersecurity insurance typically covers the following:

• Data Breach

If a data breach occurs and personal information is stolen, you're required by law to notify the OAIC. Not only is restoring the integrity of your systems and networks costly, but the reputational and legal consequences of data breaches can destroy your business. The good news is that cyber insurance can help reduce and mitigate the costs of a data breach.

• Business Interruption

If you're the victim of a password attack or DDoS attack, your business operations might be heavily impacted, preventing your customers from purchasing from you or your employees to work. Every hour of downtime can cost thousands of dollars. Cyber insurance can cover you for the cost incurred by business disruptions.

•  Cyber Extortion Defense

Ransomware attacks are increasingly common, and over 61% of Australian businesses experienced one in 2021. Cyber liability insurance can provide ransomware negotiation and financial support to help recoup the losses incurred.

• Forensic Support

To assess the extent of the damage caused by the cyberattack and prevent another attack from occurring in the future, you'll need to investigate to identify vulnerabilities. Hiring forensic experts can be costly, and that's one of the things cyber liability insurance can help you with.

You'll find more information about the key benefits of getting cyber security insurance in our blog section.

At Upcover, we specialise in helping small business owners, start-ups, and independent contractors protect their businesses by providing them with highly tailored insurance. We know how devastating cybersecurity incidents can be for small companies. And we also know small business owners are highly exposed to cyber risk due to a lack of awareness and budget. 

That's why we're constantly monitoring the ever-changing cybersecurity landscape and adapting our policies accordingly. 

We're here to help, so don't hesitate to contact us if you want to discuss your cyber insurance needs with us. Alternatively, you can also use our quote generator to find the best policies for you. 

‍

Key Takeaways

‍

We hope this guide will help you build a cyber risk register as part of a robust cyber risk management plan.

If your company wants to truly prevent and mitigate cyber risks, it must be done on a company level rather than an individual level. That's why a company-wide risk register is so critical. 

It will give you as a business owner and all your management team, a bigger picture of cyber threats and risk exposure. And it will allow you to make informed decisions when it comes to harnessing opportunities by weighting their positive impact versus cyber threats' likelihood and consequences.

Combining a well-designed and maintained risk register with cyber insurance and ongoing employee training will provide the tools you need to reduce and mitigate your cyber risks and protect your business.

‍