Lion Cipher Lab
Build your first risk register (the table GRC teams live in)
- GRC / Compliance
- Beginner
- ~45 min
- Free · no account required
Why it matters
A risk assessment is a way of thinking; a risk register is the artifact that thinking produces — and it is the single document GRC teams open most. It is where a security program decides, in writing, what could go wrong, how bad each risk is, what is being done about it, who is responsible, and when it gets looked at again. Auditors ask to see it. Leadership steers by it. Learning to build and maintain one is one of the most directly employable, resume-shaped skills in the whole field, and you can produce a genuine one this afternoon for things you already own.
What you'll learn
- risk register
- likelihood vs. impact
- risk treatment (accept/mitigate/transfer/avoid)
- risk ownership
- GRC deliverables
Steps in this lab
- Meet the risk register — the artifact GRC lives in
- The anatomy of a register: what each column is for
- Step 1 — identify your assets
- Step 2 — name the risks (threat meets weakness)
- Step 3 — rate likelihood and impact, then compute the risk level
- Step 4 — decide a treatment for each risk
- Step 5 — assign an owner and a review date, then assemble the register
- What you just built — and why it counts