Virtual CISO · Risk management
A risk register your board can actually decide from
Most registers are a spreadsheet somebody updated before the last audit: forty rows, all red, no owners, no dates, and nothing a director could reasonably act on. Yours is built from your business, scored before and after the work, and ends in decisions with names attached.
Built from your business, not downloaded and renamed
A register is only useful if the people named in it recognize the risks as theirs. Three things go into yours.
A standard set, adapted
We start from an established catalogue of cyber risks rather than inventing forty of them in a workshop, then rewrite each one in terms of what it would actually do to you — which system, which process, which customer.
The ones only you know about
The dependency on a single supplier, the server nobody will turn off, the process that exists because one person has always done it that way. These never appear in a catalogue and they are usually the ones that matter.
The register you already have
If there is an existing spreadsheet, it comes in rather than being thrown away. Work already done on it keeps its wording and its owners, and it stops being a parallel document that slowly disagrees with the real one.
Two numbers per risk, and the distance between them is the work
Every risk is scored twice: inherent, as it would be with nothing in place, and residual, as it is with your actual controls. Both are impact against likelihood on a five-by-five scale, and both are shown as a heatmap so the shape of the register is visible without reading forty rows.
The residual score is not set once and admired. As remediation tasks close, the risks they mitigate are rescored, and the second heatmap moves while the first one stays where it was. Those two pictures side by side are the clearest answer there is to the question of what the money bought.
Every risk gets a decision, and “we are aware of it” is not one of them
For each risk there are four things you can do, and exactly one of them has to be chosen: reduce it, accept it, transfer it, or avoid the activity that creates it. A risk with no treatment decision is not a managed risk, it is a noted one, and a register full of noted risks is what an auditor finds in week one.
Alongside the decisions sits a tolerance threshold agreed with your management: the level above which a residual risk is not allowed to simply sit there. When a risk is scored above it, the register says so on the risk itself rather than leaving somebody to notice.
- Reduce — controls and tasks, with owners and dates, until the residual score comes down
- Accept — a formal, dated decision by a named person, with a reason and an expiry
- Transfer — insurance or a contract, recorded with what it actually covers
- Avoid — stop doing the thing, which is occasionally the correct and unpopular answer
Accepting a risk is a decision with a name and a date on it
Some risks are not worth fixing, and saying so out loud is legitimate risk management. What is not legitimate is the version where nobody quite decided, nobody signed anything, and a year later the question is what the board knew and when.
So an acceptance is recorded as a decision: who accepted it, on what date, for what stated reason, and until when. It goes to the audit log and cannot be edited afterwards. When the acceptance expires the risk comes back for a fresh decision rather than lapsing quietly into permanence.
NIS2 puts the approval of risk-management measures on the management body itself and attaches liability to it. A record like this is what turns “the board approved the measures” from an assertion into something you can show. It does not make a decision correct, and it does not move the obligation — it evidences that the decision was taken, by whom, and on what basis.
A handful of key risks, each with the work behind it
Flagging a risk as a key risk puts it in the management report. The point of the flag is scarcity: four or five risks a board can hold in its head beats forty it will skim, and the ones that earn the flag are the ones where the residual score still exceeds tolerance.
Open one and the argument is already assembled — what the risk would actually cost, in money and in hours, which controls are in place, which tasks are still open and who owns them, when it was last reviewed, when it is next due, and an audit log of every change anyone made to it.
- Every risk carries the tasks that mitigate it, with their real status rather than an intention
- A risk with no tasks against it is flagged, because that is a treatment decision nobody implemented
- Residual scores move as tasks close, not when somebody remembers to update the sheet
- The audit log keeps every change, including the ones made the week before an audit
Re-scored, re-checked, re-decided
A register that is written once is wrong within a quarter, because the business moves and the controls land. Before each management review we go back through it: residual scores recalculated against what actually closed, key risks re-examined, acceptances that are near expiry pulled out for a decision, and new risks added from whatever changed — an acquisition, a new supplier, a system that went live.
The output is not a refreshed document. It is a short list of the decisions your management needs to make this quarter, each with what we recommend and what it would cost to do differently.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
You do, always. Accepting a risk is a management decision with consequences that land on your organization, not on your advisers, and NIS2 puts the approval of risk-management measures on the management body itself. What we do is make the decision a real one: we quantify the risk, lay out what reducing it would cost against what accepting it exposes, recommend a course, and record what you decide — who, when, why, and until when. We also come back when it expires, which is the part that otherwise gets forgotten.
Yes, and we would rather you did than start a competing one. An existing register comes in by upload, up to a hundred rows at a time, keeping its wording and its owners so the work already done is not lost. Expect some rewriting afterwards: most inherited registers describe threats rather than business consequences, and a board cannot decide from "ransomware".
Every quarter as a whole, and continuously in part. The quarterly pass happens before your management review: residual scores recalculated against what actually closed, key risks re-examined, expiring acceptances pulled out for a decision. In between, a risk moves whenever the work against it moves — closing a mitigating task rescores the risk it mitigates, rather than waiting for somebody to update a document.
Mostly, and the gaps are worth naming. The register is built for the risks that reach your information and your operations — suppliers, people, physical access, continuity and the systems the business runs on, which is wider than most people mean by "cyber". What it is not is an enterprise risk register: currency exposure, a legal dispute or a market shift belong somewhere else, and we will say so rather than quietly file them here.
Where this sits, and what comes next
Scanning
What an attacker sees from outside, what the directory looks like inside, monthly.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.