Manage identified risks over time: rate inherent and residual risk on the SP 800-30 scale, choose a NIST risk response, assign owners and review dates, and track residual exposure as controls take effect, all in your browser.
A risk assessment captures a moment. A risk register (SP 800-37 Rev 2) is the repository you keep: each risk carries an owner, a chosen response, controls, a residual rating, and a next-review date, so nothing is identified once and then forgotten.
Rate inherent risk before treatment and residual risk after, both on the SP 800-30 likelihood and impact scale, and the register shows your exposure trending down as controls take effect.
Capture each risk, treat it, rate the residual, and keep it under review. Every field aligns with how SP 800-37 and SP 800-39 describe managing risk over time.
Record a clear risk statement, pick an SP 800-30 threat-source category (adversarial, accidental, structural, environmental), and rate inherent likelihood and impact. Add risks manually, or import an assessed risk straight from your Risk Assessment.
Select a NIST risk response (mitigate, accept, avoid, transfer, or share) per SP 800-39, and record the controls or plan that reduce the risk. Cite SP 800-53 control identifiers to keep the register consistent with your SSP and assessments.
Re-rate likelihood and impact after treatment to show the risk you are left with. The register makes the difference between inherent and residual explicit, so reviewers can see the effect of your controls at a glance.
Assign an accountable owner, a status, and a next-review date so each risk stays under active monitoring rather than going stale. Sort and filter by owner, status, category, or residual level to manage the register day to day.
Track treated risks rising and high residual risks falling over time. Export the register to CSV or a print-ready report for leadership, and re-import a saved JSON to pick up where you left off.
The register is fully usable for free. Pro adds saving, exporting, and reporting so it fits an ongoing risk-management program.
Save the complete register as a JSON file and reload it later, or save straight into a local folder (Chrome / Edge). Keep a versioned history as risks are opened, treated, and closed.
Generate a spreadsheet of every risk with inherent and residual ratings, response, owner, status, and review date for distribution to stakeholders or GRC tooling.
Produce a clean, print-ready risk register report for leadership, an authorizing official, or a board risk committee.
Focus the register on what matters, such as high residual risks that are still open, using column sort, per-column filters, and show/hide column controls.
Start adding risks immediately: no setup, no account required, and your data stays in your browser. Pro adds save, export, and reporting when you are ready.
Risk Posture Tools