16.2 Simple Personal or Small-Team Risk List
The Risk Register, Field by Field
A risk register is one spreadsheet row per risk, and a beginner needs only about ten columns: a unique ID, the asset, the threat, the vulnerability being exploited, likelihood, impact, the combined score, an owner who is a named person, a chosen treatment, a target date, and a status like open, treating, accepted, or closed. Two fields people forget are owner and next-review date; without them a register decays into a list of worries nobody acts on. Keep one risk per row -- "laptop problems" hides three different risks with three different fixes, and merged rows cannot get a single owner or status.
Scoring and Risk Appetite
Score likelihood and impact each on a 1-5 scale, then multiply: a ransomware hit on the only copy of your client database might be 4 x 5 = 20, while a defaced marketing site might be 2 x 2 = 4. Decide your risk appetite up front -- say anything scoring 15 or higher is unacceptable today -- and every row that exceeds appetite flips to "treat now" while lower rows wait their turn. The threshold matters more than the exact numbers; it converts a pile of scores into a ranked to-do list.
Finding Your Real Single Points of Failure
Small-team lists surface hidden dependencies fast. Ask what one device, account, or service stops everything if it fails: the single router bridging the whole office, the one NAS that is also the only backup target, the shared admin password on a founder's personal email, the SaaS tool whose outage means no invoices can go out. Log outages as they happen -- duration, cause, and workaround -- because three months of outage notes turn vague fears into register rows with evidence attached.
Architecture Diagram
Key Takeaways
- A register row needs asset, threat, vulnerability, likelihood, impact, score, owner, treatment, date, and status.
- Score likelihood x impact on 1-5 scales; the arithmetic matters less than consistent ranking.
- Set an appetite threshold first so scores automatically become act-now versus watch rows.
- Hunt single points of failure: one device, account, or service whose loss stops operations.
- Record real outages to replace guesswork with evidence when you re-score.