Cybersecurity Glossary
Risk Register
The living list of your known risks, their owners and what is being done about each.
What Risk Register means
A risk register records each risk, its score, the person accountable, the treatment chosen and the review date. Treatment is one of four choices: reduce it, transfer it through insurance or contract, avoid the activity, or accept it deliberately. Accepting a risk is legitimate as long as it is recorded and signed.
Why Risk Register matters for small businesses and nonprofits
It converts security from a vague anxiety into a set of decisions with names attached. It is also the document auditors, insurers and larger clients ask to see first.
What to do about Risk Register
- Keep it short enough that leadership will read it, ideally one page
- Give every entry a named owner, not a department
- Review it at a standing meeting rather than only before an audit
Not sure where you stand on this?
We review your current setup against the basics, tell you plainly what is covered and what is not, and give you a ranked list with effort and cost. No jargon and no scare tactics.