Lion Cipher Lab
Build a risk register
- GRC / Compliance
- Beginner
- ~50 min
- Free · no account required
Why it matters
A risk register is the single most common artifact in governance, risk, and compliance (GRC) work — the running list, usually a spreadsheet, of the things that could go wrong for an organization, how bad each would be, who owns it, and what is being done about it. Almost every security program, audit, and framework points back to one: it is where 'are we secure?' becomes a concrete, prioritized, owned list you can actually act on and show to a boss, an auditor, or a client. Building one teaches the mental model that underlies the whole field: risk is not a vague feeling of danger, it is…
What you'll learn
- what a risk register is
- identifying risks (asset, threat, vulnerability, consequence)
- scoring likelihood times impact
- a 5x5 risk matrix and risk levels
- assigning risk owners
- the four risk treatments (accept, mitigate, transfer, avoid)
- residual risk
- risk appetite
- GRC fundamentals
Steps in this lab
- The five words this lab runs on
- Open a spreadsheet and write your scope at the top
- Build the columns — the exact layout of a register
- Identify your risks — the asset, threat, vulnerability, consequence recipe
- Score each risk: likelihood times impact on a 1-to-5 scale
- Turn scores into levels, and assign one owner to each risk
- Decide the treatment: accept, mitigate, transfer, or avoid
- Track residual risk, and check it against your risk appetite
- What you built, and the mindset to keep