RSK-02Risk and Decisions
Risk register with owners and treatment
Risks are recorded with inherent and residual judgement, an owner, a treatment decision and a review date.
Why it exists
A register nobody owns is a list.
What usually proves it
Risk register, treatment plans, review evidence.
Smaller organizations
A spreadsheet reviewed quarterly by the leadership team.
Mapped to
- Fully addressedSOC 2 Trust Services Criteria · CC3.4
- Fully addressedISO/IEC 27001 Annex A · 6.1.3
- Fully addressedNIST Cybersecurity Framework · ID.RA-05
- Partially addressedPCI DSS · 12.3.1 — Targeted risk analyses only, not an enterprise register.
- Fully addressedHIPAA Security Rule · 164.308(a)(1)(ii)(B)
- Deliberately absentGDPR — No register of organizational risk is required; Art. 30 requires a record of processing activities, which is a different artefact.
- Fully addressedEU AI Act · Art. 9(2)
- Fully addressedNIST AI Risk Management Framework · MANAGE 1.3