The text of the Cybersecurity Risk Register Template
Approval #
| Role | Name | Signature |
|---|---|---|
| Chief Information Security Officer (CISO) |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year with the Risk Management Strategy (PLAN-RMS-001), and after the National Institute of Standards and Technology (NIST) changes the IR 8286 series.
Mandate. NIST SP 800-53 Rev. 5 controls PM-9, RA-3, and PM-4 require the Organization to record its risks, respond to them, and track the response. NIST IR 8286 Rev. 1, published in December 2025, describes the cybersecurity risk register and how it rolls up to the enterprise risk profile. Office of Management and Budget (OMB) Circular A-123 suggests a risk profile that may focus on cybersecurity. The Risk Management Strategy (PLAN-RMS-001) sets the scales, the tolerances, and who may accept each risk.
1. How to Use This Template #
The Information System Security Officer (ISSO) keeps each system’s risk entries. The CISO keeps the organization-level cybersecurity risk register. Both use the fields in this template, so the CISO can combine entries from every system. The register lives in the governance, risk, and compliance (GRC) system, which holds risk acceptances and plan of action and milestones (POA&M) items too.
Follow these rules for every entry:
- Record every risk rated Moderate or higher, every risk outside a tolerance, and every risk an official accepts.
- Write the risk description as a scenario with a threat, an asset, a method, and a harm.
- Rate likelihood and impact with the NIST SP 800-30 Rev. 1 scales, and take the exposure rating from the risk matrix in the Risk Management Strategy.
- Link each mitigation to its POA&M items, and each accepted risk to its signed risk acceptance.
- Update each system’s entries [Assignment: organization-defined frequency for updating each system’s risk register entries — to be defined], and after each assessment, major change, or major incident.
- Update the organization-level register [Assignment: organization-defined frequency for updating the organization-level cybersecurity risk register — to be defined].
Keep each register entry to a summary. Put details such as test results and meeting notes in the risk detail record that NIST IR 8286A Rev. 1 describes, kept with the entry in the GRC system.
Evidence: the register entries with their change history in the GRC system.
2. Register Fields #
The first fields follow Table 1 of NIST IR 8286 Rev. 1. The Organization adds the asset, threat, vulnerability, tolerance, residual risk, POA&M, acceptance, escalation, and date fields.
| Field | What to enter | Allowed values or format |
|---|---|---|
| Risk ID | A unique number for the risk. | RR-YYYY-NNN: the year, then a number in order |
| Priority | How urgent the risk is compared with others in the register. | 1 (highest) to 5 |
| Risk tier | Where the risk lives. | Organization; mission or business process; system |
| Risk description | The risk scenario in one or two sentences: the threat, the asset, the method, and the harm. | Free text |
| Asset or system | The system, High Value Asset, data set, or service at risk. | Name from the system inventory |
| Threat | The threat source and the threat event. | NIST SP 800-30 Rev. 1, Appendix D and E terms |
| Vulnerability | The weakness or predisposing condition the threat would use. | Finding, Common Vulnerabilities and Exposures (CVE) number, or condition |
| Risk category | The theme that groups like risks, for the roll-up. | A category in the Risk Appetite and Tolerance Statement |
| Likelihood | How likely the scenario is before any new response. | Very Low to Very High |
| Impact | How severe the harm would be before any new response. | Very Low to Very High |
| Exposure rating | The level of risk from the risk matrix in the Risk Management Strategy. | Very Low to Very High |
| Within tolerance | Whether the risk is within the Risk Appetite and Tolerance Statement, and which measure applies. | Yes or no, with the measure |
| Risk response type | The chosen response. | Mitigate, accept, transfer, or avoid; for an opportunity, realize, share, enhance, or accept |
| Risk response description | What the response does, with the control identifiers. | Free text |
| Risk response cost | The estimated cost of the response. | Dollars or staff hours |
| Risk owner | The official accountable for the risk and its response. | Role and name |
| Status | Where the risk stands now. | Open; response in progress; accepted until a date; monitoring; closed |
| Residual risk | The level of risk expected after the response, and the target level. | Very Low to Very High |
| POA&M link | The POA&M item numbers for the mitigation. | POA&M ID in the GRC system |
| Risk acceptance | The acceptance reference, the official who signed it, and its end date. | Reference and date |
| Escalation | Whether and when the risk went to the risk executive function or the enterprise risk profile. | No, or the date and the body |
| Dates | When the risk was found, last reviewed, and next due for review. | YYYY-MM-DD for each |
3. Example Entry #
This example shows one completed entry. The values are invented to show the format.
| Field | Example entry |
|---|---|
| Risk ID | RR-2026-004 |
| Priority | 1 |
| Risk tier | Organization |
| Risk description | An external attacker uses a stolen session token to reach the cloud email and file service and copies personally identifiable information (PII) from shared folders. |
| Asset or system | Cloud email and file service |
| Threat | Adversarial: organized criminal group. Event: session token theft and replay. |
| Vulnerability | Shared folders that allow access from any device, and sessions that last 24 hours. |
| Risk category | PII and sensitive financial and transaction data |
| Likelihood | High |
| Impact | High |
| Exposure rating | High |
| Within tolerance | No. The appetite level for this category is Minimal. |
| Risk response type | Mitigate |
| Risk response description | Require compliant devices for the service and shorten sessions to 8 hours (AC-12, AC-19). Turn on data loss prevention rules for PII (SC-7(10)). |
| Risk response cost | 120 staff hours |
| Risk owner | System Owner of the cloud email and file service |
| Status | Response in progress |
| Residual risk | Expected: Low. Target: Low. |
| POA&M link | Two POA&M items for the device and session rules |
| Risk acceptance | None |
| Escalation | Sent to the risk executive function at its last meeting; added to the enterprise risk profile. |
| Dates | Found 2026-08-04; last reviewed 2026-10-01; next review 2027-01-05 |
4. Blank Entry #
Copy this table for each new risk when the GRC system is not available, and enter it in the GRC system within 5 business days.
| Field | Entry |
|---|---|
| Risk ID | |
| Priority | |
| Risk tier | |
| Risk description | |
| Asset or system | |
| Threat | |
| Vulnerability | |
| Risk category | |
| Likelihood | |
| Impact | |
| Exposure rating | |
| Within tolerance | |
| Risk response type | |
| Risk response description | |
| Risk response cost | |
| Risk owner | |
| Status | |
| Residual risk | |
| POA&M link | |
| Risk acceptance | |
| Escalation | |
| Dates |
5. How Risks Roll Up to the Enterprise Risk Profile #
The CISO sends cybersecurity risks to the enterprise risk management program [Assignment: organization-defined frequency for sending cybersecurity risks to the enterprise risk profile — to be defined]. The steps follow NIST IR 8286 Rev. 1 and NIST IR 8286C Rev. 1: gather, normalize, rank, and send.
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| ISSO | Completes or updates each system risk at or above Moderate in the GRC system, with every field in this template. | The GRC system | System register entries | RA-3, PM-9 |
| CISO | Gathers the system and mission entries into the organization-level register and removes duplicates. | The GRC system | Combined register | PM-9 |
| CISO | Puts every entry on the same scales and categories, so like risks can be compared, as NIST IR 8286C Rev. 1 describes. | The GRC system | Normalized register | PM-9 |
| CISO | Ranks the risks by exposure, mission effect, and business impact analysis results, as NIST IR 8286B and NIST IR 8286D describe. | The GRC system | Ranked register | PM-9, CP-2 |
| CISO | Sends the top risks, and every risk outside tolerance, to the enterprise risk management program. | The document management system | Roll-up report | PM-9 |
| Chief Risk Officer (CRO), or the Chief Financial Officer (CFO) where the Organization has no CRO | Adds the cybersecurity risks to the enterprise risk register and the risk profile. | The document management system | Enterprise risk profile | PM-9 |
| Senior Accountable Official for Risk Management | Sends enterprise decisions back to the CISO, who updates the register. | The GRC system | Decision record | PM-9, PM-29 |
Evidence: the combined and ranked registers, the roll-up reports, the enterprise risk profile, and the decision records.
6. Update Schedule #
| Activity | How often | Who |
|---|---|---|
| Update each system’s register entries | [Assignment: organization-defined frequency for updating each system’s risk register entries — to be defined], and after each assessment, major change, or major incident | ISSO |
| Update the organization-level register | [Assignment: organization-defined frequency for updating the organization-level cybersecurity risk register — to be defined] | CISO |
| Send cybersecurity risks to the enterprise risk profile | [Assignment: organization-defined frequency for sending cybersecurity risks to the enterprise risk profile — to be defined] | CISO |
| Review the register with the risk executive function | [Assignment: organization-defined frequency of risk executive function meetings — to be defined] | Senior Accountable Official for Risk Management |
| Review a risk acceptance before it ends | 30 days before its end date | ISSO |
7. Records #
The ISSO and the CISO keep the register entries, the risk detail records, and the roll-up reports in the GRC system and the document management system. They keep them as long as the system’s authorization records.
Evidence: the register, its history, and the roll-up reports.
8. Derived Governance Requirements #
- Keep an enterprise risk profile that includes cybersecurity risk, overseen by a Risk Management Council, as a recommended practice. (OMB Circular A-123, §VII)
- Include cybersecurity risk management activities and outcomes in enterprise risk management processes. (NIST CSF 2.0, GV.RM)
- Use the annual strategic review to analyze enterprise risk, which may include developing a risk profile. (OMB Circular A-11, §260.8)
- Use cybersecurity risk registers to record and communicate each cybersecurity risk, its exposure, its response, and its owner. (NIST IR 8286 Rev. 1, §2.1)
- Aggregate, normalize, and analyze cybersecurity risk registers before sending cybersecurity risk to the enterprise risk register. (NIST IR 8286C Rev. 1, §2)
9. References #
These are the sources this document cites, with a link to each official text.
- NIST Cybersecurity Framework 2.0, February 26, 2024.
- NIST IR 8286 Rev. 1: Integrating Cybersecurity and Enterprise Risk Management (ERM), December 18, 2025.
- NIST IR 8286A Rev. 1: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, December 18, 2025.
- NIST IR 8286B: Prioritizing Cybersecurity Risk for Enterprise Risk Management, February 26, 2025.
- NIST IR 8286C Rev. 1: Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight, December 18, 2025.
- NIST IR 8286D: Using Business Impact Analysis to Inform Risk Prioritization and Response, February 26, 2025.
- NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments, September 2012.
- OMB Circular A-11: Preparation, Submission, and Execution of the Budget, August 29, 2025.
- OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.