risk-register
Skill0 starsChanged 13 days agoMITView on GitHub
Build and maintain a cybersecurity risk register — risk statements (threat, vulnerability, asset, impact), inherent and residual ratings, treatment decisions, owners, key risk indicators and review cadence — aligned with NIST CSF 2.0 Govern, ISO/IEC 27005 and enterprise risk management. Use when creating or auditing a risk register, translating findings into risks, or preparing risk reporting for leadership.
10 other projects use a version of this.
Adopted by
Most recently taken up by
- grcmana/grc-ostheir own version, first seen Nov 8, 2026
- grcmana/grcskillstheir own version, first seen Nov 8, 2026
- MRCalderon3D/everything-game-dev-codetheir own version, first seen Oct 13, 2026
- microsoft/hve-coretheir own version, first seen Oct 13, 2026
- lzx-Bill/Project-Factory-Coretheir own version, first seen Jul 15, 2026
- kenmulford/PMSkillstheir own version, first seen Apr 19, 2026
Other versions10 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 10
- microsoft/hve-core★ 1.6ksame name
- MRCalderon3D/everything-game-dev-code★ 105same name
- zbruhnke/claude-code-starter★ 16same name
- Dokkabei97/forged-claude-code★ 2same name
- grcmana/grc-os★ 2same name
- grcmana/grcskills★ 2same name
- Vaibhavkkm/vkkm-aegis-plugin★ 2same name
- aakash-dhar/claude-skills★ 0same name
- kenmulford/PMSkills★ 0same name
- lzx-Bill/Project-Factory-Core★ 0same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-inventorySkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- The first 60 shown.
The file
Files
Cybersecurity Risk Register
Write a proper risk statement
"[Threat] could exploit [vulnerability/condition] in [asset/process], resulting in [business impact]." Example: "Ransomware operators could exploit internet-exposed VPN appliances without timely patching to access the corporate network, resulting in multi-day outage of order processing and data-theft extortion."
A finding ("VPN patch missing") is not a risk; many findings roll up to one risk.
Register fields
| Field | Notes |
| ID, title, statement | As above |
| Category | e.g., CSF 2.0 function / ERM taxonomy |
| Asset/process & owner | Business owner accepts risk, not IT |
| Inherent likelihood × impact | Organization's scale (e.g., 1–5) with defined criteria (financial bands, downtime hours, regulatory) |
| Existing controls | Specific, with effectiveness evidence |
| Residual rating | After controls |
| Treatment | Mitigate / transfer (insurance, contract) / avoid / accept |
| Plan & due date | Linked tickets |
| KRIs | Measurable indicators (patch latency for edge devices, % phishing-resistant MFA) |
| Appetite comparison | Within/outside appetite |
| Review date | Quarterly for high risks |
Quantitative option for top risks: FAIR (risk-quantification-fair).
Workflow
- Gather inputs: threat intel/profile, incidents, assessments, audit findings, vulnerability trends, business changes.
- Draft risks with owners in workshops; avoid > 30–50 active top-level risks.
- Rate consistently (calibration across raters); document rationale.
- Decide treatment with owners; acceptance above thresholds needs executive sign-off.
- Report: heat map + trend, top risks outside appetite, overdue treatments, KRIs breaching thresholds.
Related skills
risk-quantification-fair, maturity-assessment, security-exception-management, security-metric-definition
References
- NIST CSF 2.0: https://www.nist.gov/cyberframework
- NIST IR 8286 series (integrating cybersecurity and ERM): https://csrc.nist.gov/pubs/ir/8286/r1/final
- ISO/IEC 27005:2022 information security risk management (standard; purchase required)
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.