control
risk register
A short written list of what could go wrong, how bad it would be, who owns it and what was decided. It is the document that lets you show your measures fit the risk, and the reason to do less where the risk is low.
- what it protects
- the choice of measures, so effort goes where the risk is
- who owns it
- a named owner per risk, with the board for acceptances
- start with
- the five services the business cannot run without, and one threat to each
what it is
A risk register is a list of what could go wrong. For each entry it says how likely it is, how bad it would be, who owns it and what was decided: reduce it, transfer it, avoid it or accept it.
Every rule in the register asks for measures that fit the risk, and the register is how you show that they do. NIS2 asks for risk analysis policies and for measures that are appropriate and proportionate. DORA asks for a documented framework. GDPR asks for security that fits the risk to people, which needs its own column.
No text here prescribes a method. Pick one short enough that the board reads it, and use it the same way each time. Start from the services and assets that matter most and work outward.
basis NIS2 Art. 21(2)(a), 21(1); DORA Art. 6(1); GDPR Art. 32(1). The method is practice.
how a risk becomes a decision
- 1name itone sentence, tied to a service or an asset
- 2score itlikelihood and impact on a short scale, the same way each time
- 3decidereduce, transfer, avoid or accept, with a name and a date
- 4link the workthe control that reduces it and the evidence it leaves
the review date, and any change that cannot wait for it
basis working practice. No legal text sets this.
an example
Picture a company of 200 people that wrote a risk register for an audit.
It has two hundred rows, a scoring method copied from a standard and no owners. Nobody has opened it since the audit, and the highest risks sit open with no decision.
It has twenty risks, each with a name, a score on a three by three scale, a decision and a date. The board signs the acceptances and reads a one-page view. A lighter measure has its reason written beside it.
An illustration. It is not a real case.
what it has to do for each rule
| rule | where | what the text asks | what the control has to do |
|---|---|---|---|
| NIS2 | NIS2 Art. 21(2)(a) | Policies on risk analysis and information system security. | Keep a written analysis with a decision, an owner and a date for each risk, and revisit it when something changes. |
| NIS2 | NIS2 Art. 21(1) | Measures appropriate and proportionate to risk, exposure, size, likelihood and severity. | Record why each measure is the size it is, so a lighter measure has a written reason. |
| IR 2024/2690 | IR 2024/2690 Annex 2.1 | Listed digital providers: a risk management framework. | Describe how risks are found, scored and decided, in a document the board can read. |
| DORA | DORA Art. 6(1) | A documented ICT risk management framework. | Keep the register as part of that framework and show the management body has seen it. |
| GDPR | GDPR Art. 32(1) | Security appropriate to the risk to people. | Add a column for the risk to individuals, so the same register supports the choice of measures for personal data. |
basis NIS2 Art. 21(2)(a), 21(1); IR 2024/2690 Annex 2.1 as a reference; DORA Art. 6(1); GDPR Art. 32(1). What the control has to do is practice.
what to look for when you choose
- Can each entry carry a description, a likelihood, an impact, an owner, a decision, a date and a link to the asset or service it concerns?
- Does it keep history, so you can show what the score was last year and why it changed?
- Can it record a risk acceptance with a name and a date?
- Does it support a short method you can explain to the board, such as three points for likelihood and three for impact?
- Can it flag entries that are past their review date or have no owner?
- Can it link a risk to the control that reduces it and to the evidence that control leaves?
- Can it produce a one-page view for the board and the full list for the team?
- Does it separate the risk to the company from the risk to people?
basis working practice. No legal text sets this.
three levels, from first step to strong
Each level adds something visible. Stop where the risk you accepted allows.
- start
Write the services the business cannot run without and one thing that could stop each. Give each an owner.
- solid
Use a short written method, record a decision and a date for every risk, and put the register in front of the board once a year.
- strong
Link each risk to the asset, the control and the evidence, keep the history of scores, and add a column for the risk to people.
basis working practice. No legal text sets this.
where it goes wrong
a famous method nobody follows
No text here prescribes one. A short written method you use beats a large one you do not.
two hundred risks
A register that long gets no owners. Twenty with names are worth more.
written once for an audit
It only helps if it sets the order of the work. If nothing changed because of it, it is not doing its job.
accepted by nobody
A high risk left open with no signed acceptance is a risk that nobody decided about. Put a name and a date on every acceptance.
basis working practice. No legal text sets this.
the proof it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| risk register: risk, score, decision, owner, date | named risk owner | twice a year |
| signed risk acceptances | board | yearly |
| board minute or paper that shows the register was reviewed | board secretary or chief executive | yearly |
| the written method: how risks are scored and what each score triggers | head of IT | yearly |
basis practice. The rhythms are your choice.
check it yourself
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2690 (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
your next step
Write down the five services the business cannot run without and one thing that could stop each.