Lion Cipher Lab
Compare two risk register snapshots and report what moved
- GRC / Compliance
- Intermediate
- ~35 min
- Free · no account required
Why it matters
A risk register is only useful if someone watches how it changes. NIST SP 800-39 makes monitoring risk one of its four core risk-management activities, and NIST IR 8286 describes cybersecurity risk registers being reviewed and rolled up into enterprise risk reporting. In practice the quarterly review often shrinks to one chart: the average score went down, well done. That chart can hide the quarter's most important fact. One risk can climb to the maximum while others fall, a risk marked 'treating' can be getting worse, a risk can drop out of the register with no record of why, or a score can…
What you'll learn
- diffing two quarters of a risk register
- separating new, closed and silently vanished risks
- ranking score movement instead of reporting an average
- flagging 'treating' risks that got worse
- catching owner changes and stale reviews
- writing the quarterly risk movement report
Steps in this lab
- Monitoring means comparing, not averaging
- Two quarters of the register
- Write the snapshot diff
- Run it: the average fell, the quarter did not improve
- Make it the standing quarterly report