How Does Risk Register Work?

The Risk Register is a step you will complete as part of the Register and Modules. The Risk Register will provide a complete overview of the risks that are in your company. From physical to digital risks, all should be included. This register is the backbone of your ISO 27001 certification.

Accessing Risk Register

There are 2 ways to access the Risk Register:

1. Through the Risk Register step in the Implementation steps;
2. Through Registers and Modules.

Accessing through Risk Register Step

Follow these steps to access the Risk Register:

1. Go to Compliance and select Implementation steps;
2. Find the Risk Register and click on the step or the Arrow button;
3. From the step, click the Open Register button.

Accessing through Registers and Modules

Follow these steps to access the  Risk Register:

1. Click on Registers and Modules in the menu;
2. Click the Go To Register button on the  Risk Register module.

Risk Register Overview

The Risk Register is divided into the following sections:

1. Assets;
2. Vulnerabilities;
3. Threats;
4. Evaluation;
5. Review;
6. Treatment;
7. Approval.

Assets

Assets are divided into the following categories:

1. Infrastructure;
2. IT & Communication Equipment;
3. Software & Databases;
4. Other Documents and data;
5. Human Resources;
6. Third-party Services.

Conformio suggests up to 30 assets based on the company size Conformio is aimed for (Small and Medium-sized Enterprises). You can select more assets if needed.

Type of Assets

You should include only the assets that you directly control. Those are the assets which you can directly set the security rules for.

Creating Assets

If you have an asset not already listed, you can create your own under the provided categories.

To create an asset, do the following:

1. Click the Add an Asset Not Listed in This Category button;
2. Enter all information;
3. Click the Add an Asset button.

You must select at least one asset in each category to proceed to Vulnerabilities by clicking the Next button.

If there is an empty category of assets, the error message appears where you can proceed, but with the risk of failing certification.

Vulnerabilities

You need to provide a vulnerability for every selected asset in the previous selection screen. Conformio suggests several possible vulnerabilities. If a vulnerability is specifically occurring in your company but is not on the Conformio list, you can create it.

Creating Vulnerabilities

To create a vulnerability, do the following:

1. Click the Create a New Vulnerability at the end of the vulnerabilities’ list;
2. Input vulnerability name and category;
3. Click the Next button;
4. Select Applicable Controls (at least 1);
5. Click the Create Vulnerability button.

Conformio suggests up to 240 vulnerabilities based on the company size Conformio is aimed for (Small and Medium-sized Enterprises). You can select more assets if needed.

Type of Vulnerabilities

Threats and vulnerabilities are used to describe a risk that is related to a particular asset.

Vulnerability is a characteristic of an asset (e.g., a flaw or absence of protection) that allows a threat to materialize. It is always related to a particular asset.

A threat is a cause of a security incident (something bad that will happen) that exploits the vulnerability to damage the asset.

In other words, if there is no vulnerability, a threat cannot materialize. If there is no threat, then vulnerability cannot be exploited.

When all your vulnerabilities are successfully selected for each asset, click the Next button to proceed.

Threats

Risk Register defines what threats are connected to previously selected assets and vulnerabilities.

Conformio suggests up to 720 threats based on the company size Conformio is aimed for (Small and Medium-sized Enterprises). This will translate to 720 risks.

Matching Threats to Vulnerabilities

Vulnerabilities are related to particular assets, so when analyzing your assets, you should think through which characteristics of an asset (i.e., a flaw or lack of protection) will enable a threat to materialize.

Threats exploit those vulnerabilities, so you should consider what kind of bad things can happen to those assets – threats can be a force majeure, internal organizational oversight, unintentional human errors (malicious attacks or technical faults.)

Creating Threats

If you have a threat not already listed, you can create your own.

To create a threat, do the following:

1. Click the Add a New Threat at the end of the threats list;
2. Input threat name and category;
3. Click the Next button;
4. Select Applicable Controls (at least 1);
5. Click the Create Threat button.

You must have at least one threat selected for each vulnerability and asset to proceed to Evaluation by clicking the Next button. Otherwise, you might have an incomplete risk assessment, which can be the reason you fail your certification.

Evaluation

The Evaluation phase covers the selection of multiple values aimed at declaring the risks in your company as Acceptable or Not Acceptable, shown under the Level field and calculated by a 3×3 matrix.

Asset, Vulnerability, and Threat fields are non-editable as they were selected in the previous steps.

You have to input the Impact and Likelihood fields of the threat occurring.

Both variables are on a scale of 0 to 2:

• If impact and likelihood combined create a value above 2, the risk becomes Not Acceptable;
• If impact and likelihood combined create a value of  2 or below, the risk becomes Acceptable.

You have to select a Risk Owner – this is usually a person responsible for this asset. It is mandatory to select all the data up to this point.

If you have mistakenly selected a risk, you can discard it by clicking the X icon in line with the risk identification number R-000.

Unacceptable Risks

It is expected to have some unacceptable risks during your initial risk assessment. Any unacceptable risks will be lowered with selected controls in the Treatment step of the Risk Register.

Based on our experience, you will likely fail the certification audit without any identified unacceptable risks.

Review

In the Review step, you review all inputs in the risk Register until now and ensure the risk level values are properly evaluated.

Note: This is the last time you can discard the risk.

Treatment