Write a risk register entry somebody can actually act on

short · 35 min · Objective 5.2

Task

Turn five vague concerns into risk register entries with the fields that make them actionable, and assign a response strategy to each. 'Ransomware' is not a risk statement, and the difference is what this lab makes concrete.

Steps

  1. Start from five one-word concerns: ransomware, insider, vendor, cloud, leaver.
  2. Rewrite each as a cause-and-consequence sentence: what happens, to what, with what result for the business. A risk statement that contains no consequence cannot be assessed.
  3. Write /tmp/register.csv with the columns id,risk_statement,inherent_likelihood,inherent_impact,existing_controls,residual_likelihood,residual_impact,owner,strategy,actions,review_date.
  4. Choose a strategy for each from transfer, accept, avoid and mitigate, and make sure at least three different strategies appear — if everything is 'mitigate', no decision has been made.
  5. For the one you accept, record who accepted it and the date it is revisited. Acceptance without a named person is not acceptance.
  6. For the one you transfer, write one sentence on what does NOT transfer with it.

Verify

python3 - <<'PY'
import csv,re
rows=list(csv.DictReader(open('/tmp/register.csv')))
assert len(rows)>=5, 'fewer than five entries'
for r in rows:
    s=r['risk_statement']
    assert len(s.split())>=12, 'risk statement too short to contain a consequence: '+s[:40]
    assert r['owner'].strip(), 'no owner for '+r['id']
    assert re.match(r'\d{4}-\d{2}-\d{2}', r['review_date'].strip()), 'no review date for '+r['id']
strats={r['strategy'].strip().lower() for r in rows}
print('strategies used:',strats)
assert len(strats)>=3, 'fewer than three distinct strategies - nothing was decided, everything was mitigated'
acc=[r for r in rows if r['strategy'].strip().lower()=='accept']
assert acc, 'nothing was accepted - acceptance is a legitimate decision and the register should show one'
print(len(rows),'entries, all owned, dated, with',len(strats),'strategies')
PY
grep -ciE "does not transfer|obligation|reputation" /tmp/register-notes.md

The assertions enforce the three things that make a register usable: statements long enough to contain a consequence, a named owner, and a review date. The strategy diversity check is the interesting one — a register where every row says 'mitigate' records intentions rather than decisions.

Notes

What does not transfer is worth writing down in your own words. Insurance moves the money; the regulator still holds you responsible, your customers still blame you, and the story still runs. That is the most commonly tested nuance in this objective.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.