Cyber risk register

Library and custom risk

The cyber risk register starts from a library of known risks that you adopt for your organization. Anything not there enters as a custom risk, following the same flow as the other domains: you relate controls — picking from the library or accepting Ara's suggestion — and residual starts deriving from those controls' maturity.

From the related controls the risk inherits, read-only, the associated vulnerabilities and attack techniques. That spares you from maintaining by hand the link between a business risk and the technical catalog underneath it.

Exposed surface

There is a short view kept deliberately separate from the matrix: what is reachable from outside, ordered by what it would cost to lose. It crosses the asset's exposure with its technical criticality and marks which of those assets also carry an open threat.

That distinction changes what the list is. An exposed asset with an open threat is a work queue; an exposed asset nobody has reported anything about is an inventory. Conflating the two turns an actionable list into a long one.

This screen uses the asset's own technical criticality, not the criticality derived from the BIA — on purpose. Business criticality is already the risk matrix's axis, and repeating it here would give the same asset two different criticalities on two screens. What this list answers is what an operator can act on today.