Lesson 7: Build a Professional Risk Register

After learning to identify risk and validate one control, you are ready to manage a professional decision. Build a risk register for a synthetic payroll service: define scope, score impact and likelihood, record inherent risk, choose treatment, verify residual risk, and sign an owner and review date

Score impact and likelihood to decide what is urgent. Record risk before treatment, verify the controls, then record what remains and who must review it again.

Corporate Governance: The set of rules, procedures, and structures defining how an organization is managed and overseen; in cyber — setting responsibility, roles, and decision authority from the top.
Risk Appetite: The level of risk an organization is consciously willing to accept in pursuit of its business objectives.
Impact Grade: Severity of damage per CIA on a 1–4 scale: 1 negligible, 2 limited, 3 severe, 4 catastrophic.
Likelihood: An estimate of the chance an event occurs, based on four inputs: threat intelligence, incident history, attacker motives, and organizational vulnerability.
Risk Matrix: A table combining Impact and Likelihood into a risk level; values are predefined and not necessarily a simple arithmetic product.
Risk Treatment: The managerial decision on how to handle a risk: mitigate, accept, transfer (insurance), or avoid.
Controls Bank: A comprehensive catalog of defenses, aligned with standards like NIST, used to treat and reduce risks that have been identified and priced.
Implementation Depth: The idea that a control is not binary (present/absent) but implemented in levels — from a basic manual process to full automation.