Understanding the Risk Register
A practical starting point for logging your first information security risks: what makes a good risk entry, how scoring works, and common risks to start with.
Why Start with the Risk Register
Every ISMS is built around understanding what could go wrong and how bad it would be. The Risk Register is where you turn that thinking into a structured, auditable record. You don't need a complete risk assessment on day one — start with a handful of obvious risks and build the register out over time as your ISMS matures.
Five Risks Most Organisations Start With
If you're staring at an empty register, these five cover the majority of ISO 27001 risk assessments and are a reasonable place to begin:
- Data breach — unauthorised access to or disclosure of customer or employee personal information.
- System outage — loss of availability of a critical system or service.
- Phishing — a staff member is tricked into revealing credentials or installing malware.
- Insider threat — a current or former employee misuses their access, maliciously or accidentally.
- Third-party vendor failure — a supplier or service provider suffers a security incident that affects your organisation.
Logging Your First Risk
Click Add Your First Risk (or Create Risk once you have others) and work through the form:
- Title and description — name the risk plainly (e.g. “Phishing leads to compromised admin credentials”) and describe the scenario: how it could happen, and what the impact would be if it did.
- Score it — rate likelihood and consequence from 1 to 5 each. Don't overthink precision here; a reasonable estimate is enough to start, and you can revise it at your next review.
- Choose a treatment — accept, mitigate, transfer, or avoid. Most risks end up mitigated — tied to a control you're implementing (or plan to implement) in your Statement of Applicability.
- Assign an owner — the person accountable for keeping an eye on this risk and following through on its treatment.
Once saved, the risk appears on the heat map and contributes to your overall risk posture. See Risk Register for the full scoring matrix, severity bands, and how risks connect to your SoA and Asset Register.