Each client has a risk register — a structured list of the threats and vulnerabilities you have identified for that client. The register feeds the client's posture grade: open risks pull down the relevant pillars, so working the register is how you improve a CyberAssurance Score. This article covers adding a risk, the fields, and how risks affect posture.
Where the Register Lives
Open a client from the Portfolio (View Details). The right-hand side of the client detail page shows the Risk Register summary alongside Recovery health. The register lists each risk with its status and risk rating.
Adding a Risk
- On the client detail page, click Add Risk in the Risk Register panel.
- Fill in the fields:
- Threat — what could cause harm (for example, "Ransomware via phishing").
- Vulnerability — the weakness the threat exploits (for example, "No MFA on email").
- Inherent risk — a 1–10 rating of the risk before any mitigation (slider). 10 is the most severe.
- Asset ID (optional) — the affected asset, if you want to tie the risk to a specific system.
- Click Add Risk.
The risk is added to the register and counts toward the client's threat and plan-maturity posture.
Risk Fields
| Field | Meaning |
|---|---|
| Threat | The adverse event |
| Vulnerability | The weakness exploited |
| Inherent risk | Severity before mitigation (1–10) |
| Residual risk | Severity after mitigation/controls |
| Status | Open / mitigated / closed |
| Due date | Target date for treatment |
| Owner | Who owns the treatment |
How Risks Affect Posture
Open risks lower the relevant pillar scores in the CyberAssurance Score. The workflow to improve a client's posture is:
- Add the risks you have identified to the register.
- Treat them — implement controls, then record the residual risk and move the status toward closed.
- Re-run discovery and Recompute Score so the improved posture is reflected.
Reviewing the register is also how you decide remediation priorities for a Fair-range client (500–749): the highest inherent-risk open items are usually the right place to start.
FAQ
Why didn't my score change after I added risks? Adding or closing risks does not recompute the score automatically. Use Recompute Score on the client detail page after changing the register.
What is the difference between inherent and residual risk? Inherent risk is the severity with no controls in place. Residual risk is what remains after you apply controls. Tracking both shows the value of the work you have done.
Can I tie a risk to a specific asset? Yes — set the optional Asset ID when adding the risk.