From the course: IT and Cybersecurity Risk Management Essential Training

Unlock the full course today

Join today to access over 24,000 courses taught by industry experts.

Using an IT risk register

Using an IT risk register

From the course: IT and Cybersecurity Risk Management Essential Training

Start my 1-month free trial Buy for my team

Using an IT risk register

“

- [Instructor] Once you start looking for IT risks, you'll find a lot of them. So you'll need a place to write them down. That place is called a risk register. Neither NIST 800-30 nor 800-39 use the term risk register, but NIST does define the term inside their inter-agency report number 8286 as a repository of risk information, including the data understood about risks over time. Oddly enough, ISO 31000 doesn't use the term risk register either, but it does state that risks need to be documented. However, ISO guide 73, which is called risk management vocabulary does define a risk register to be a record of information about identified risks. Despite this inconsistency among the common standards, we'll use the term risk register, and this lesson will show you how to make one and use one. A typical risk register could contain many data fields, including a risk category to group similar risks, such as system availability or…

Contents