Security Risk Register
A security risk register is the record of risks owned by the security function, holding scenarios that could cause loss to the organization along with their owners, treatment decisions and current status.
Where It Sits
Most organizations run three registers at different altitudes, and confusion between them is common because all three are called registers.
The enterprise risk register sits above, holding risks across every category including financial, operational, legal and security. The vulnerability register sits below, holding technical weaknesses found on specific assets. The security risk register sits between them, holding the scenarios the security function owns and reports upward.
What an Entry Contains
A scenario describing an event that could cause loss, an owner accountable for the treatment decision, the current assessment of likelihood and impact, the treatment chosen and its status, and a review date. Entries number in the tens rather than the thousands.
Scenarios in a well-built register are not all technical. Insider action, supplier failure and regulatory change produce no scan finding and belong in the register regardless, which is why a register populated only from scanning output is incomplete by construction.
How It Differs From a Vulnerability Register
By the unit each holds. A vulnerability register carries one entry per weakness per asset, is owned by security operations and moves daily. A security risk register carries one entry per scenario, is owned by risk or governance and moves quarterly.
Neither summarizes the other. The two registers compared sets out where organizations double-count between them and where entries fall through the gap between the two.
What Makes One Useful
Entries expressed in a unit that supports a decision. A register rating risks as high, medium and low can order them and cannot compare any of them against a control budget or an insurance limit, because an ordinal score and an amount of money share no common term.
Cyber risk quantification applied to register entries produces figures comparable to spend, to risk appetite thresholds and to coverage limits.
Related Terms
Turn Cyber Risk Into Financial Exposure the Board Can Act On
Security leaders are being asked to defend budgets, prioritize controls, and report cyber risk in the same terms as every other enterprise risk. Kovrr's CRQ Platform models loss scenarios, benchmarks control performance, and gives the C-suite a defensible view of where cyber sits on the balance sheet.
