← GRC Hub
Risk Register
ISO/IEC 27005-aligned register with inherent and residual 5×5 matrices, multi-engagement support and optional FAIR-lite Monte Carlo. All data stays in your browser.
Methodology v1.0.0 ·
Threat catalogue v1.0.0 ·
reviewed 2026-06-10 ·
methodology
| ID | Title | Asset | Threat | Inherent | Residual | Treatment | Owner | Status | Review | Action |
|---|
No risks in this engagement yet. Click + Add risk to start.
Levels
Low (1–4)
Medium (5–9)
High (10–14)
Critical (15–25)
Likelihood × Impact = risk level. Click a cell to see the risks in it.
Export
Import CSV
Upload a CSV with a header row. You'll be asked to map your columns to the register fields.
Likelihood scale (1–5)
| Level | Name | Description | Frequency anchor |
|---|---|---|---|
| 1 | Rare | Less than once every 10 years; would require a very unusual combination of failures. | < 0.1 events / year |
| 2 | Unlikely | Once every 3-10 years; possible under unusual circumstances. | 0.1 – 0.3 events / year |
| 3 | Possible | Once every 1-3 years; could happen under specific conditions. | 0.3 – 1 events / year |
| 4 | Likely | More than once a year; happens during normal operations. | 1 – 12 events / year |
| 5 | Almost certain | Multiple times per year; expected in current conditions. | > 12 events / year |
Impact scale (1–5)
| Level | Name | Financial € | Operational | Regulatory |
|---|---|---|---|---|
| 1 | Insignificant | 0–10,000 | No material impact on services. | No regulatory consequence. |
| 2 | Minor | 10,000–100,000 | Brief degradation of non-critical services. | Minor finding; no enforcement action. |
| 3 | Moderate | 100,000–1,000,000 | Hours of disruption to critical services. | Reportable to authority; formal observation. |
| 4 | Major | 1,000,000–10,000,000 | Day-long outage of critical services. | Enforcement action; potential fine. |
| 5 | Catastrophic | 10,000,000–∞ | Multi-day outage; safety/customer harm. | Major enforcement; potential licence consequences. |
FAIR-lite
FAIR-lite uses a triangular distribution Monte Carlo for Loss Event Frequency × Loss Magnitude. Outputs P10/P50/P90 annualised loss exposure. Treat as an estimate; link to FAIR Institute for the full methodology.
Iterations: 10000; Loss Event Frequency and Loss Magnitude both modelled as triangular distributions (min / likely / max).
Informational only — not legal advice. Risk methodology aligned to ISO/IEC 27005:2022 principles; FAIR-lite simplifies the full FAIR model and should be treated as an estimate.