How we deliver the risk register

Raise it in a sentence. We keep it scored and reviewed.

A concern from your team, a finding from our specialists, or an exception from an access review enters the Portal as a proposed risk. Our CISO confirms it with a reason, scores it, and reviews it on a schedule.

Book a discovery call See the platform

It starts when

Six moments put a risk on the register.

Some start with your team and some start with ours. Each one reaches the same review by our CISO, so the register reflects the work as it happens.

Someone spots a concern
A person on your team notices something and proposes it in the Portal in a sentence. It goes straight to our CISO for review.
A security finding needs a decision
A finding from our security operations work reaches a point where the business chooses how to handle it. Our CISO proposes it as a risk.
A Security Exception request comes in
Someone asks for an exception to a standard. It lands on the register as an exemption, with an expiry date.
An access review turns up an exception
A reviewer finds access that needs to stay for a reason. The exception routes to the register with its reasoning attached.
A vulnerability needs a risk decision
A vulnerability needs a decision on how it is handled. Our CISO proposes the risk, and you accept it with a reason and an expiry date.
A review date arrives
Every risk carries a review cadence. When the date comes, our CISO reviews the risk and records what changed.

What our CISO does

We keep the register true.

Our CISO stands between every proposal and the register, and stays with each risk after it is confirmed.

Confirm or decline each proposed risk
Our CISO reviews every proposal and either confirms it into the register or declines it with a reason the proposer can read. Exceptions routed in from access reviews and Security Exception requests pass through the same gate.
Score it and place it
We score inherent and residual risk, and we set the NIST CSF 2.0 program area, so every risk sorts by what deserves attention first.
Review it on its cadence
Each risk is reviewed on its own schedule. Every change lands in the audit trail, so the register shows how a risk moved over time.
Recommend a treatment
We recommend how to handle the risk, and you acknowledge the recommendation in the Portal.

What you see in the Portal

Every proposal ends in a decision you can read.

Your team proposes a risk in a sentence, and the Portal shows it moving through review. Our CISO confirms it into the register or declines it with a reason.

Our specialists

Raised from the work

The specialists running your cloud, IT, and security create risks as they surface them, straight from the work that turned them up.

Your team

Proposed in a sentence

Your admins and security leads propose a risk the moment they notice one, from wherever they sit. The people closest to a problem are often the first to see it.

CISO review

Confirmed or declined

Every proposed risk sits in review until our CISO confirms it into the register or declines it with a reason. Everything your team raises ends in a decision.

Illustrative. The review path every proposed risk follows before it enters the register.

Each proposal ends in a decision, and each decision carries a reason.

Anatomy of a risk

One record holds the score, the area, and the history.

Open any risk in the Portal and the decision is on the page, with the record of how it got there.

The register in the Portal: each risk with its owner, score, and review date.

Owner

One named person accountable for the risk, so ownership rests somewhere specific.

Inherent and residual score

How much the risk matters before controls, and how much it matters after them. Both sit on the record, so the register sorts by what deserves attention first.

NIST CSF 2.0 program area

Each risk is placed in a program area of NIST CSF 2.0, so you can read the register by the part of your security program it touches.

Review cadence

The schedule our CISO reviews the risk on, with the next review date in view.

Change history

Every change to the risk is recorded in its audit trail, so when someone asks why a risk looks the way it does, the answer is already written down.

PDF export

The register exports as a PDF, ready to hand to a board, a buyer, or an assessor.

Exemptions

An exception arrives as a request and carries an expiry date.

When a standard needs a different path, your team opens a Security Exception request. Our CISO records it on the register, and it shows its end date alongside the reason.

It starts as a Security Exception request. Your team opens it in the Portal, and our CISO reviews it.
Every exemption has an expiry date. The date sits on the record, so keeping an exemption past it is a deliberate decision.
Access review exceptions arrive here too. An exception found in an access review routes to the register, so exceptions from both places are read together.
It sits with the risk it answers. Anyone reading the register sees the exception and the reason for it together.

What you sign

You propose, acknowledge, and accept.

Your team proposes a risk in a sentence. When our CISO recommends a treatment, you acknowledge it. When our CISO proposes a vulnerability risk, you accept it with a reason and an expiry date.

How vulnerabilities are handled

What you keep