Risk Register.

A living inventory of identified risks with their description, owner, scores, treatment, and status, used to track the organization's exposure over time. It belongs to the Compliance & Frameworks category of cybersecurity.

A living inventory of identified risks with their description, owner, scores, treatment, and status, used to track the organization's exposure over time.

A risk register is the central record produced by risk management activities. Each entry typically captures a unique identifier, a clear risk description, affected assets or processes, threat sources, inherent and residual scores, the risk owner, agreed treatment, key controls, and review dates. The register is reviewed at defined intervals and updated when new threats emerge, projects change, or incidents occur. It supports board reporting, internal audit, regulator inquiries, and prioritization of security investment. A well-maintained register avoids both blind spots and risk fatigue by keeping entries actionable rather than turning into a static spreadsheet.

Defences for Risk Register typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Risk log, Cyber risk register.