Free template

ISO 27001 risk register template

The three documents clauses 6.1.2 and 6.1.3 produce: the risk criteria and method, the risk register, and the treatment plan with the owners' acceptance of what remains.

Set the criteria first: the scales and the acceptance level decide every rating that follows, and the auditor checks the results are consistent with them.

Every risk needs an owner who can approve its treatment and accept what remains. Repeat the assessment at the interval you set and whenever something significant changes.

The guide behind it: ISO 27001 Risk Assessment: Complete Guide to Information Security Risk Management

[Company] information security risk criteria

Owner	[Role, not a person's name]
Approved by	[Name, title]
Effective date	[YYYY-MM-DD]
Review cadence	[Annually, and after significant change]
Version	[1.0]

Likelihood scale

Score	Label	Meaning
1	Rare	[Not expected in the next [N] years]
2	Unlikely	[Could happen once in [N] years]
3	Possible	[Could happen once a year]
4	Likely	[Expected several times a year]
5	Almost certain	[Expected monthly or more]

Impact scale

Score	Label	Meaning
1	Negligible	[No customer impact, no data exposed]
2	Minor	[Short disruption, internal data only]
3	Moderate	[Customer-visible disruption or limited personal data exposed]
4	Major	[Contract breach, regulator notification, significant data exposed]
5	Severe	[Loss of customers or licence, large-scale breach]

Risk level and acceptance

Risk level = likelihood × impact, from 1 to 25.

[1 to 6]: Low. Acceptable; the risk owner records the acceptance.
[8 to 12]: Medium. Treat within [N months] or accept with [role]'s approval.
[15 to 25]: High. Treat before [date or event]; acceptance needs [top management].

Method and frequency

Risks are identified against [the assets in the inventory / the services and processes in scope], by [role] with the owners of those assets.

The assessment is repeated every [12 months] and after significant change, such as a new product, a new provider or a serious incident.

[Company] risk register

Risks

One row per risk. Rate before treatment, then estimate the residual rating once the selected controls are in place.

ID	Asset or process	Threat and vulnerability	Owner	Likelihood	Impact	Level	Treatment	Residual level
R-01	[Customer database]	[Leaver keeps access; no prompt removal]	[Role]	[3]	[4]	[12]	[Modify: A.5.18]	[4]
R-02	[Production cloud account]	[Misconfiguration exposes data]	[Role]	[3]	[5]	[15]	[Modify: A.8.9, A.8.16]	[5]
R-03	[Payments provider]	[Supplier outage stops checkout]	[Role]	[2]	[4]	[8]	[Share: contract terms; modify: A.5.30]	[4]

[Company] risk treatment plan

Treatments

Options: modify the risk with controls, avoid it, share it with a third party, or retain it. List the controls the same way the Statement of Applicability does.

Risk ID	Option	Controls	Action	Owner	Due	Status
[R-01]	[Modify]	[A.5.18]	[Tie removal to the HR leave date]	[Role]	[YYYY-MM-DD]	[Open]

Residual risk acceptance

Risk ID	Residual level	Accepted by	Date	Review by
[R-01]	[4]	[Risk owner, title]	[YYYY-MM-DD]	[YYYY-MM-DD]

All templates

FAQ

Frequently asked questions

Talk to us

Do we have to use a five-point scale?

No. ISO 27001 asks for a method that gives consistent, valid and comparable results, not a particular scale. Three, four or five points all work if they are defined and used the same way every time.

Does every risk need a control?

No. A risk can be avoided, shared or retained as well as modified with controls. Retaining a risk is legitimate when the owner accepts it on the record, which is what the acceptance table is for.

Trust, settled.

Templates are the start. Noru drafts the policies from your own setup, tracks approvals and acknowledgements, and keeps the evidence.

Book a demo More templates