Risk Matrix Builder
Rate each risk for likelihood and impact, see where it lands on the heatmap, and export the register for your risk review or audit pack.
How to rate
Add a risk
Enter a title for the risk.
Level:
Heatmap
Each cell shows how many open risks sit there (closed risks are not counted). Select a cell to list only its risks.
Risk register
No risks yet. Add one with the form, or select Load example register to see how it works.
| # | Title | Category | L | I | Score | Level | Owner | Mitigation | Status | Actions |
|---|
How the level is worked out
Score bands. Score = likelihood × impact.
- 5 × 5: Low (1-4), Medium (5-9), High (10-14), Critical (15-25), the same bands as the GRC risk register.
- 3 × 3: Low (1-2), Medium (3-4), High (6-9).
NIST SP 800-30 risk table. Likelihood and impact each use NIST’s five levels (Very Low, Low, Moderate, High, Very High). The risk level is read from Table I-2 of NIST SP 800-30 Rev. 1 (Guide for Conducting Risk Assessments, Appendix I), not multiplied. For example, a High-likelihood, Very High-impact risk is Very High, and a Moderate-likelihood, High-impact risk is Moderate.
Neither method is a standard you must follow. Write down what each level means for your organization (money, downtime, people affected) so that two assessors rate the same risk the same way.