IT Risk Register

Risk value: Row effects, column probability
	1 - rare	2 - unlikely	3 - possible	4 - reliable	5 - almost safe
5 - critical	5	10	15	20	25
4 - significant	4	8	12	16	20
3 - medium	3	6	9	12	15
2 - minor	2	4	6	8	10
1 - negligible	1	2	3	4	5

1. Governance and responsibility

R-01: No responsibility for information securityRisk: Decisions remain without the owner and the risks are not processed.Verification: Check that the management has appointed the responsible authority and approved the authority.Proof: Management decision and description of the position.NIS2: article 20.
R-02: Management does not approve and supervise risk management measuresRisk: Security does not receive resources and management learns about risks only in an incident.Verification: Examine the last management review and decisions taken.Proof: Minutes of the meeting.NIS2: article 20.
No list of assets with ownersRisk: Nobody updates or protects an unaccounted system.Verification: Compare the list with the network scan result.Proof: List of assets with owners.NIS2: 21 (2) (i).
No uniform risk assessment methodRisk: Risks cannot be compared, and resources go wrong.Verification: Check that the criteria and acceptance thresholds are in writing.Proof: Risk methodology with criteria.NIS2: 21(2)(a).
R-05: Security policies are outdated or unknown to employeesRisk: Employees act according to custom and requirements cannot be proved.Verification: Check the review date and the presentation notes.Proof: Policy with version and note.NIS2: 21(2)(a).

2. Identity and access

R-06: Compromised user accreditation dataRisk: The attacker loges as a real user, and controls do not notice it.Verification: Check MFA coating and leakage monitoring.Proof: MFA overview of accounts.NIS2: 21 (2) (j).
R-07: Administrator's accounts do not contain MFARisk: One stolen password gives full control of the system.Verification: Remove all administrators and their MFA status.Proof: List of administrators with MFA status.NIS2: 21 (2) (j).
R-08: Users have more rights than they needRisk: One account compromises much more data and systems.Verification: Comparatively compare your rights to the needs of your position.Proof: The result of the access review.NIS2: 21 (2) (i).
R-09: Overhead accounts remain assetsRisk: A former employee or attacker uses an account that no one monitors.Verification: Compare active accounts with the list of staff.Proof: The result of the comparison and the closure note.NIS2: 21 (2) (i).
Shared and service accounts unsupervisedRisk: The action cannot be linked to a person and the password is not changed for years.Verification: Pull out service accounts, their owners and password age.Proof: Service account list.NIS2: 21 (2) (i).
Remote access without adequate protectionRisk: Publicly available RDP or VPN without MFA is a frequent intrusion site.Verification: Check external ports and VPN application conditions.Proof: External scanning output and VPN settings.NIS2: 21 (2) (j).

3. Net and perimeter

R-12: Flat network without segmentationRisk: One infected workstation reaches servers and backups.Verification: From the user network try to reach the server and management ports.Proof: Network diagram and connectivity test.NIS2: 21 (2) (e).
External services seem openRisk: Forgotten service with outdated version is open door.Verification: Compare external scanning to the approved list of crews.Proof: Scan output.NIS2: 21 (2) (e).
R-14: Firewall regulations not revisedRisk: Temporary exceptions remain and are allowed more than necessary.Verification: Select the terms without the owner or review date.Proof: Recording of the statement of terms.NIS2: 21 (2) (e).
R-15: DDoS attack interrupts service availabilityRisk: Customers cannot access, and load exceeds channel or server capacity.Verification: Check protection, limits and contact with the service provider.Proof: Contract or test result.NIS2: 21(2)(c).
R-16: DNS or domain control is lostRisk: The attacker directs the site and email, and customers do not notice it.Verification: Check registrar MFA, domain blocking and deadline.Proof: The recorder setting shall be printed.NIS2: 21 (2) (j).

4. Systems and vulnerabilities

R-17: Critical patches are not installed on timeRisk: Some vulnerability is used before it is closed.Verification: Compare patch level to CISA KEV and your term.Proof: Patch report with dates.NIS2: 21 (2) (e).
R-18: Software used without manufacturer supportRisk: New injuries will no longer be corrected.Verification: Select versions of the list of assets with final support.Proof: List of time limits for support.NIS2: 21 (2) (e).
R-19: Safe configuration baseline missingRisk: Default settings and passwords remain in the product.Verification: Compare the model system with CIS Benchmark.Proof: Comparison report.NIS2: 21 (2) (e).
R-20: Malignant or ejecting virus encrypts dataRisk: Action stops, and recovery lasts days or weeks.Verification: Check the EDR coverage and date of the restoration attempt.Proof: EDR review and renewal protocol.NIS2: 21 (2) (b).
R-21: Missing or not viewing magazinesRisk: The attack goes unnoticed, and the incident cannot be investigated.Verification: Create a test event and check that it reaches the centre and gives a warning.Proof: Foot and shelf life of the test event.NIS2: 21 (2) (b).

5. Data and backups

R-22: Backup not updatedRisk: The copy will look valid until needed.Verification: Resume the test medium and the time of the dimensions.Proof: Timed renewal test.NIS2: 21(2)(c).
R-23: The attacker can delete or encrypt copiesRisk: The spy virus also reaches copies and there is no recovery path.Verification: Check the unchangeable or separately stored copy and its access.Proof: Storage Settings.NIS2: 21(2)(c).
R-24: Release of personal dataRisk: Notice, penalty and loss of customer confidence occur.Verification: Check where the data is stored, accessed and found in the leak.Proof: Data processing register and access report.NIS2: 21 (2) (i).
R-25: Sensitive data not encryptedRisk: The stolen disk, copy or extract from the database shall be immediately readable.Verification: Check the encryption of laptops, copies and broadcasts.Proof: Encryption status review.NIS2: 21 (2) (h).
R-26: Management of cryptographic keys and certificates not specifiedRisk: The expired certificate stops the service, or the leaked key remains valid.Verification: Check key list, deadline alerts and rotation.Proof: List of certificates with time limits.NIS2: 21 (2) (h).

6. Development and supply chain

R-27: Compromised supplier or service providerRisk: The attacker enters through a reliable connection or update.Verification: Check the list of critical suppliers and the security requirements for contracts.Proof: Assessment of suppliers.NIS2: 21(2)(d).
One supplier without substituteRisk: His failure or departure stops a critical process.Verification: Select critical suppliers without an exit plan.Proof: The exit plan.NIS2: 21(2)(d).
R-29: Injured third party dependenceRisk: A certain CVE library is produced.Verification: Start SCA and check that the finds stop the construction.Proof: SCA report and SBOM.NIS2: 21 (2) (e).
R-30: Coded or configured secretsRisk: The leaked key gives direct access, also after deletion from history.Verification: Launch secret scanning throughout the history of the repository.Proof: Scan output.NIS2: 21 (2) (e).
Changes in production without reporting and return pathRisk: An incorrect change stops the service or opens a hole.Verification: The change from demand to output shall be randomly tracked.Proof: The change shall be recorded with confirmation.NIS2: 21 (2) (e).

7. Continuity and incidents

R-32: Not audited recovery planRisk: At the moment of a mistake, decisions are made for the first time.Verification: Check the date and conclusions of the last training.Proof: Training protocol.NIS2: 21(2)(c).
R-33: No recovery targetsRisk: It is not known what needs to be updated first and how much data can be lost.Verification: Test RTO and RFMO critical systems and compare with test.Proof: Impact analysis with RTO and RFMO.NIS2: 21(2)(c).
R-34: One failure point in a critical systemRisk: The failure of one node or channel stops the entire service.Verification: The critical flow of exits and the components without reserves are flagged.Proof: Architecture scheme with notes.NIS2: 21(2)(c).
R-35: Incident not recognised and reported on timeRisk: The 24-hour early warning and 72-hour notice are missed.Verification: Plays a sample incident with a time measure to report.Proof: Study time line and contacts.NIS2: article 23.

8. People and the physical environment

R-36: Employee opens phishing letterRisk: It's the most common intruder.Verification: An authorised phishing test and measurement reporting rate shall be performed.Proof: Test result.NIS2: 21 (2) (g).
R-37: Lack of security trainingRisk: The employee does not recognize the threat or know who to report.Verification: Check the coverage of training, including management.Proof: Training records.NIS2: article 20.
One person's knowledge of a critical systemRisk: In his absence, nobody can restore the system.Verification: Check documentation and substitute.Proof: Instructions and replacement.NIS2: 21 (2) (i).
R-39: Unauthorised physical access to servers or devicesRisk: Physical access to bypass most network controls.Verification: Check the room access log and visitor order.Proof: Access log.NIS2: 21 (2) (i).
Work device lost or stolenRisk: Data and active sessions come into foreign hands.Verification: Check disk encryption and remote deletion.Proof: MDM review.NIS2: 21 (2) (h).

IT Risk Register

How to assess the risk

Risk level

Potential

Impact