Product / Risk register
A risk register in plain words
Write down what could go wrong, score it, bring it under your limit and have its owner sign it off. Made for the risk assessment ISO 27001, NIS2 and DORA ask for.
Scoring
Score = how likely × how bad
Both run from 1 to 5. The heat map draws your limit across it, so you see at a glance which risks are over it.
1–4
Low
5–9
Medium
10–15
High
16–25
Critical
Four steps
Every risk, the same four steps
The register shows what each risk needs next: an owner, a score, measures, a review or a sign-off.
1
Written down
Say what could go wrong, in plain words, and who owns it. Start from your own list or from the threat library.
2
Scored
How likely, and how bad, each from 1 to 5, in the words your risk method gives each level. The reason goes with the score.
3
Under your limit
Over your limit? Put measures in place and score it again. The first score stays in the history, so the drop is on record.
4
Signed off
The owner signs off what is left and says why. A new score needs a new sign-off.
What is in it
What an auditor asks for, kept as you work
The method, the scores, the sign-offs and the reviews are on record the moment they happen.
Your risk method
Set your limit, what each level means and how often risks are reviewed. Publish it as a version: every score keeps the version it was made under.
A threat library
Threats from ISO/IEC 27005 and ENISA, grouped by kind. See the ones nobody has looked at yet, and add a risk from any of them.
Checks on threats
Where Sudory's automated checks watch a threat, its page shows whether they pass, and which ISO 27002 controls reduce it.
Reviews on schedule
Every risk comes up for review every 1 to 12 months. The owner hears 14 days before and on the day. Keep the scores and say what you checked, or score it again.
Sign-offs that run out
A sign-off can end on a date. The owner hears 30 and 7 days before it runs out.
A history an auditor can read
Every score, sign-off and review, with who did it, when and why.
From a spreadsheet to a register you can sign
Bring your risks or start from the threat library. Sudory keeps the scores, sign-offs and reviews an auditor asks for.