Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is a Risk Register?

Definition

A risk register is a living list of the security risks a business faces, with each risk's likelihood, impact, owner, planned response, and status. It turns "we should probably worry about ransomware" into a tracked item with a name next to it and a date to check back, so decisions about security spending can be explained and revisited.

How It Works

Each row in a risk register usually captures:

  • The risk, written as a cause and effect, such as "a stolen admin password leads to a Microsoft 365 takeover."
  • The asset affected: data, systems, money, or reputation.
  • Likelihood and impact, on a simple scale such as low, medium, and high.
  • The response. NIST IR 8286 lists "four types of actions available" for negative cybersecurity risks: "accept, transfer, mitigate, and avoid." Buying cyber insurance is transfer; adding MFA is mitigation; dropping a risky service is avoidance; documenting a conscious decision to live with something is acceptance.
  • The owner responsible for the response, and a due date.
  • Current status and the remaining risk after controls.

The register is fed by a risk assessment, then updated whenever the business changes, an incident happens, or a new threat appears. NIST notes that not every method produces a document called a risk register, but strongly urges organizations "not yet familiar with or using risk registers" to adopt them.

The register's real value is the review. A short quarterly meeting where the owner looks at the top risks, checks progress, and makes explicit accept-or-fix decisions is worth more than a perfect spreadsheet that nobody opens.

Real-World Example

On August 18, 2025, HHS's Office for Civil Rights announced a $175,000 settlement with BST & Co. CPAs, a New York accounting and consulting firm that handled health information as a HIPAA business associate. BST discovered ransomware on part of its network on December 7, 2019. OCR found BST "had failed to conduct an accurate and thorough risk analysis." The corrective action plan requires a risk analysis and a risk management plan "to address and mitigate security risks and vulnerabilities identified." OCR's director called a risk analysis "essential for identifying where ePHI is stored and what security measures are needed to protect it."

Why It Matters for a Small Business

Small businesses cannot fix everything at once, so they need a way to choose. A risk register shows what was considered, what was fixed first, and what was knowingly accepted, which is exactly what regulators, insurers, and larger customers ask about after an incident. The BST case shows the reverse: without a documented risk analysis, a ransomware attack became a regulatory finding and a two-year plan monitored by OCR. It also helps the owner say no with confidence: a risk that has been reviewed and knowingly accepted is a business decision, not an oversight.

How to Spot It / How DTS Handles It

Warning signs: security spending decided by the latest scare, no written record of risks or decisions, questionnaires answered from memory, and the same problems found in every audit.

DTS can help with starting a short, plain-language risk register with the owner, giving each risk a response and an owner, and setting a review schedule, such as quarterly and after any incident. See our vCISO service.

Related Terms

Sources

  • NIST, IR 8286: Integrating Cybersecurity and Enterprise Risk Management (ERM) (October 2020): https://csrc.nist.gov/pubs/ir/8286/final
  • HHS, HHS' Office for Civil Rights Settles HIPAA Ransomware Security Rule Investigation with BST & Co. CPAs, LLP (August 18, 2025): https://www.hhs.gov/press-room/hhs-ocr-bst-hipaa-settlement.html

Last updated October 14, 2026.