An external auditor asks a credit union's IT manager to show how the organization tracks its security risks. He opens a spreadsheet last edited nineteen months ago. Half the entries describe a data center the credit union moved out of last year, two of the listed owners have left, and nothing mentions the online banking platform it launched in the spring. The risks were identified once and then forgotten.
On the CompTIA Security+ SY0-801 exam, this lesson covers the parts of objective 5.2 that keep risk management running after the analysis: the risk register and how it's communicated and reviewed, the business impact analysis, risk appetite and tolerance, and the stakeholder, oversight, regulatory and legal factors that shape every risk decision.
A risk register is the single record of every known risk
A risk register is the document or system that lists each identified risk with its analysis, owner, treatment and status. Small organizations keep it in a spreadsheet; larger ones use a governance, risk and compliance (GRC) platform. The format matters less than the discipline of keeping one register that everyone uses.
| Field | What it holds |
|---|---|
| Risk ID | A unique reference, such as RISK-022 |
| Description | Cause, event and consequence |
| Category | Operational, compliance, third-party and so on |
| Owner | The accountable business leader |
| Likelihood and impact | Ratings on the agreed scales |
| Score | The combined rating, or ALE in dollars |
| Current controls | Mitigations already in place |
| Treatment | Mitigate, transfer, avoid or accept, with actions and due dates |
| Target or residual score | Expected level once treatment is complete |
| Status | Open, in treatment, accepted or closed |
| Review date | When the entry will next be re-examined |
A single entry looks like this:
ID: RISK-022
Description: A phished staff password lets an attacker deploy ransomware on the
servers behind member services, stopping transactions for up to 3 days
Category: Operational / cyber
Owner: Chief operating officer
Rating: Likelihood 3 (possible) Impact 5 (severe) Score 15 (high)
Controls: EDR on servers and workstations; nightly backups to a domain-joined NAS
Treatment: Mitigate: phishing-resistant MFA for all staff (due 2026-12-15);
immutable off-site backups (due 2027-01-31)
Target: Likelihood 2 Impact 3 Score 6 (medium)
Status: In treatment
Next review: 2027-01-15
The register also spells out exactly where the organization is weakest, so restrict who can read and edit it, as you would a penetration test report.
A register only works when it is communicated and reviewed
Communication means each audience gets the view it needs. Risk owners see their own entries, open actions and due dates. Executives see the top risks, a heat map, which risks are trending up or down and which treatments are overdue. The board sees a short summary of the most serious risks measured against the organization's appetite. Many organizations also track key risk indicators, metrics that warn a risk is growing before an incident proves it, such as the percentage of endpoints missing critical patches for more than 14 days.
Reviews keep the register true. Periodic reviews follow a calendar: high risks are often reviewed quarterly and the full register at least annually, though the schedule is set by the organization's own policy rather than by any single standard. Event-driven reviews happen when something changes: a major incident, a new system or vendor, a merger, a new regulation, an audit finding or a shift in the threats facing the industry.
In a review, each owner confirms the description still fits, re-scores the risk against current controls, checks treatment progress, and either closes the risk or keeps it open. Closed risks stay in the history rather than being deleted, so auditors can see what was decided and why. The credit union's spreadsheet failed on both counts: nobody saw it and nobody reviewed it.