A risk register that supports a decision
Describe a specific concern, its business effect and the evidence behind it. Name the person who can decide what to do, the person who implements the action, and when the decision will be reviewed. An unknown belongs on the register as a question to investigate.
Illustrative entry: recovery has not been exercised
- What is known
- Backup-job reports are available; a recent restore-test record has not been provided.
- Business concern
- The team cannot yet demonstrate recovery of the critical application against its agreed recovery needs.
- Decision and action
- Agree the recovery target, authorize a controlled exercise and record the result and unresolved issues.
- Ownership and review
- Executive sponsor approves the priority; IT owner coordinates the exercise; leadership reviews the resulting evidence at the next agreed meeting.
The entry does not say backups have failed. It states the evidence gap and the decision needed to investigate it.
Download risk register (Excel)Responsibilities people can use
For each activity, agree who performs it, who approves the decision and who needs to contribute. Discuss roles with the people involved before treating the map as an operating agreement.
Illustrative split: access review
- System owner
- Checks whether people still need their assigned access and records exceptions.
- IT team or MSP
- Provides the account list and implements approved access changes.
- Security leadership
- Defines the review process, checks the supporting records and reports unresolved gaps.
- Executive sponsor
- Resolves ownership or resource decisions and approves material exceptions within their authority.
Actual responsibilities depend on the agreed engagement. A fractional leadership role does not automatically include help desk, remediation or incident response coverage.
Download responsibility map (Excel)Evidence linked to its purpose
An evidence index identifies the requirement or process, the relevant system and period, the control owner, the record location and its review status. Keep the index distinct from sensitive evidence itself.
Illustrative entry: periodic access review
- Record requested
- The dated review, reviewed account population, exceptions and follow-up approvals.
- Owner and location
- The application owner maintains the record in an approved internal evidence repository.
- Review status
- Requested; relevance, completeness and the required period have not yet been checked.
- Next action
- Provide the record and resolve any missing scope, date or approval information.
“Requested” and “reviewed” are different states. A screenshot without context may need additional explanation. External assessors decide what is sufficient for their review.
Download evidence index (Excel)A vendor question with a clear next step
Illustrative entry: sign-in coverage needs confirmation
This is a fictional vendor-review example, not a finding about a real company.
- Relationship
- A proposed service would hold internal business records.
- Public observation
- The vendor’s public product page describes single sign-on support but does not explain which account types it covers.
- Source and review date
- Record the actual page address and the date reviewed before using this entry for a real decision.
- What remains unknown
- Whether administrators and all staff accounts can use the organization’s sign-in controls.
- Follow-up and owner
- The business relationship owner asks the vendor to confirm coverage and provide supporting information before approving access. Record the response, remaining questions and next review date.
The missing public detail is a question to resolve. It does not establish that the vendor’s controls are inadequate.
Use these as a starting point
Download an Excel workbook and open it in Excel, Google Sheets or another spreadsheet app. Each workbook includes instructions, a blank Template sheet and a separate fictional Example sheet. Adapt the fields to your organization and keep completed records in your own approved environment.
You can also read the examples on this page without downloading anything. No email or upload is required.
For the broader plan, read an illustrative first 90 days with a vCISO or what to bring to compliance readiness. NIST’s CSF 2.0 small business guide provides additional risk management context.
