Free template · For vCISOs, MSPs and IT managers
IT Risk Register Template
A risk register is the backbone of every security program and every client engagement. This template uses a 5×5 likelihood × impact model, separates inherent from residual risk, and comes with ten example risks you can adapt for a new client in minutes.
How to score (5×5 model)
Likelihood 1–5
1 Rare (less than once in 5 years) · 2 Unlikely · 3 Possible (about once a year) · 4 Likely · 5 Almost certain (several times a year).
Impact 1–5
1 Negligible · 2 Minor · 3 Moderate (noticeable outage or data exposure) · 4 Major (regulatory or customer impact) · 5 Severe (business-threatening).
Score = Likelihood × Impact
1–4 Low · 5–9 Medium · 10–16 High · 20–25 Critical. Agree the thresholds with leadership before scoring.
Inherent vs. residual
Score inherent risk before controls, then residual risk with existing controls in place. Treatment decisions are made on residual risk.
Treatment options
Mitigate, Transfer (e.g. insurance), Avoid, or Accept. Accepted risks need a named owner and a review date.
Get the full IT Risk Register Template
All 15 items, plus a spreadsheet (CSV) you can open in Excel or Google Sheets. Free — we'll email you the link too.
No spam. Unsubscribe in one click. Prefer to skip? Start free — the full framework is built in.
Run this for every client — without the spreadsheet
NovaGRC keeps a separate risk register per client workspace, with AI-assisted scoring, owners, treatment plans and heat maps that flow into board reports.
The Starter plan is free: one client workspace, up to 3 team members, no credit card.