Risk & compliance
What is a risk register?
Also known as: Information security risk register, ISO 27001 risk register
A risk register is the record of an organisation's identified risks, with for each risk its owner, likelihood and impact, the controls in place, the treatment decision and the next review date.
In information security a risk is usually described as a scenario: a threat that exploits a vulnerability of an asset, with a consequence. Scoring it before controls gives the inherent risk, after controls the residual risk, which is compared with the risk appetite to decide whether to mitigate, transfer, avoid or accept it.
How Clateway helps
- ISO 27001 risk register and risk assessment – An ISO 27001 risk register with heat maps, risk appetite, treatment plans, acceptances and AI suggestions from your own systems, vulnerabilities and vendors.
- GRC and compliance software with AI – AI-powered GRC software: generate ISO 27001, NIS2, DORA and GDPR policies, run your Statement of Applicability, controls, audit findings and management review in one place.