Write a risk register entry somebody can actually act on

short · 35 min · Objective 5.2

Task

Turn five vague concerns into risk register entries with the fields that make them actionable, and assign a response strategy to each. 'Ransomware' is not a risk statement, and the difference is what this lab makes concrete.

Steps

  1. Start from five one-word concerns: ransomware, insider, vendor, cloud, leaver.
  2. Rewrite each as a cause-and-consequence sentence: what happens, to what, with what result for the business. A risk statement that contains no consequence cannot be assessed.
  3. Write /tmp/register.csv with the columns id,risk_statement,inherent_likelihood,inherent_impact,existing_controls,residual_likelihood,residual_impact,owner,strategy,accepted_by,actions,review_date. Put double quotes round any field that contains a comma -- a risk statement long enough to carry a consequence usually does, and an unquoted one shifts every column after it, so the owner and date checks fail on content that is actually there.
  4. Choose a strategy for each from transfer, accept, avoid and mitigate, and make sure at least three different strategies appear — if everything is 'mitigate', no decision has been made.
  5. For the one you accept, record who accepted it in accepted_by and the date it is revisited in review_date. Acceptance without a named person is not acceptance. Leave accepted_by empty for the other strategies.
  6. For the one you transfer, write one sentence on what does NOT transfer with it.

Files the Verify reads

The Verify block reads these by name, so save them exactly here:

  • /tmp/register-notes.md -- your notes on the register, including what transferring a risk does not transfer.

Verify

python3 - <<'PY'
import csv,re
rows=list(csv.DictReader(open('/tmp/register.csv')))
assert len(rows)>=5, 'fewer than five entries'
for r in rows:
    s=r['risk_statement']
    assert len(s.split())>=12, 'risk statement too short to contain a consequence: '+s[:40]
    assert r['owner'].strip(), 'no owner for '+r['id']
    assert re.match(r'\d{4}-\d{2}-\d{2}', r['review_date'].strip()), 'no review date for '+r['id']
strats={r['strategy'].strip().lower() for r in rows}
print('strategies used:',strats)
assert len(strats)>=3, 'fewer than three distinct strategies - nothing was decided, everything was mitigated'
acc=[r for r in rows if r['strategy'].strip().lower()=='accept']
assert acc, 'nothing was accepted - acceptance is a legitimate decision and the register should show one'
print(len(rows),'entries, all owned, dated, with',len(strats),'strategies')
PY
grep -ciE "does not transfer|obligation|reputation" /tmp/register-notes.md

The assertions enforce the three things that make a register usable: statements long enough to contain a consequence, a named owner, and a review date. The strategy diversity check is the interesting one — a register where every row says 'mitigate' records intentions rather than decisions.

Notes

What does not transfer is worth writing down in your own words. Insurance moves the money; the regulator still holds you responsible, your customers still blame you, and the story still runs. That is the most commonly tested nuance in this objective.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.