GRC › Module 3 › Lesson 2
Risk Register
Risk register literacy names columns, risk IDs, status tracking, and review cadence — maintain register rows on YOUR $GRC_LAB fictional org as single source of truth.
Visual · t37_risk_register
Risk register literacy. $GRC_LAB only. Original Cyberlium.
Opening
Scattered spreadsheets lose audit trails — literacy teaches register structure so fictional org risks on $GRC_LAB stay traceable from assessment to treatment.
A risk register consolidates ID, description, asset, inherent and residual scores, treatment option, control references, owner, status, and review date. Version control or GRC tool history preserves changes — on Cyberlium you maintain a lab register file for YOUR fictional org under $GRC_LAB, not employer production registers without scope. Cyberlium writes register column map on YOUR $GRC_LAB — required fields, example row, review cadence for fictional org. Next: Acceptance Hygiene.
1. Register columns (named)
Risk ID: unique stable identifier. Description: scenario in plain language. Scores: inherent and residual with method reference. Treatment: option, controls, owner. Status: open, in progress, closed. Review date: quarterly or trigger-based on YOUR fictional org policy.
On $GRC_LAB, write register schema row — column name, purpose, example value for one fictional risk.
Command guide
Try these commands — Register columns (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
ISO 27001 — https://www.iso.org/isoiec-27001-information-security.html NIST CSF — https://www.nist.gov/cyberframework ISACA risk — https://www.isaca.org/resources/glossary
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export GRC_LAB=${GRC_LAB:-$HOME/cyberlium-lab/t37-grc}
export GRC_RISK=${GRC_RISK:-$GRC_LAB/LAB-ORG-001/risk}
cat > "$GRC_RISK/risk-register.csv" <<'EOF'
risk_id,asset,threat,vulnerability,likelihood,impact,risk_level,treatment,owner,status,review_date,notes
R-001,Admin SaaS console,Credential theft,Missing MFA on privileged accounts,2,3,High,Mitigate,IT Security,open,2026-09-15,Enforce MFA + conditional access
R-002,Customer PII database,Data breach,Over-broad DB role permissions,2,3,High,Mitigate,Platform Eng,open,2026-09-15,Least privilege + audit logging
R-003,Payment card flow,Skimming / PCI scope creep,CHD in non-CDE log,1,3,Med,Avoid,Compliance,open,2026-10-01,Redact PAN from app logs
R-004,Third-party CRM,Vendor breach,Incomplete DPA/subprocessor review,2,2,Med,Transfer+Mitigate,Legal+Sec,open,2026-09-30,Insurance + vendor SOC review
R-005,Dev laptops,Loss/theft,Unencrypted local secrets,2,2,Med,Mitigate,IT,open,2026-09-20,Full-disk encryption + secret manager
R-006,Legacy API endpoint,Exploit,Unsupported TLS cipher,1,2,Low,Accept,CISO,accepted,2026-12-01,Scheduled decommission Q4 — documented
EOFCommand — copy this
grep -E 'R-00[1-6]|risk_id|MFA|PCI' "$GRC_RISK/risk-register.csv"
python3 -c "print('Risk register: fictional LAB-ORG-001 rows — not production data')"Primary tools to practice this lesson: grep, python3. Reference sites: ISO 27001 (https://www.iso.org/isoiec-27001-information-security.html); NIST CSF (https://www.nist.gov/cyberframework); ISACA risk (https://www.isaca.org/resources/glossary). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why registers beat ad-hoc email threads
Auditors sample register rows against evidence — gaps in ID or owner fail quickly. Single source prevents duplicate conflicting scores. Review cadence catches stale Accepted risks that need revalidation.
Students maintain lab register on notes — production registers follow GRC platform and retention policy.
3. Lab boundary
Forbidden: copying employer live register export into lab as your work product. Allowed: risk register card — column map with $GRC_LAB fictional example row.
Ship: register column map and one example row. Next: Acceptance Hygiene.
4. What you ship: risk register schema for $GRC_LAB
Column map, example row, review cadence. $GRC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Register schema. $GRC_LAB named. File t37-m03-l02-risk-register.txt chmod 600.
6. Wrong vs right: fraudulent certs vs YOUR lab templates
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Duplicate risk IDs because 'labels don't matter.' Skip review date column.
Right
Write risk register schema for YOUR $GRC_LAB. Next: Acceptance Hygiene.
Mission: build register schema on YOUR lab org
1) List eight required columns. 2) Write one complete example row. 3) Define review cadence. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Stable risk IDs survive treatment changes — rename breaks audit traceability.
Knowledge Check
APPLY: Risk register primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Residual score reflects risk after controls are applied.
True or False
Knowledge Check
APPLY: Risk register literacy on Cyberlium uses:
Multiple choice