# Cyber Risk Register Worksheet with ALE Totals

> Source: https://netray.co/tools/cyber-risk-register-ale-worksheet
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Log cyber risks for a plant or company, compute expected annual loss before and after controls, and export a ranked register to Excel.

## Category

compliance-legal

## Industry

Manufacturing

## Audience

- IT security lead
- CISO
- Risk manager

## Tool

**Kind:** worksheet

**Mode:** editable

**Currency:** $

**Columns:**

#### Risk scenario

**Key:** risk

**Type:** text

#### Asset value at risk

**Key:** asset

**Type:** number

**Format:** currency

#### Exposure factor

**Key:** ef

**Type:** number

**Unit:** %

#### Events per year

**Key:** aro

**Type:** number

#### SLE

**Key:** sle

**Type:** number

**Expr:** asset * ef / 100

**Format:** currency

#### ALE

**Key:** ale

**Type:** number

**Expr:** asset * ef / 100 * aro

**Format:** currency

#### Treatment

**Key:** treat

**Type:** select

**Options:**

- Mitigate
- Transfer
- Accept
- Avoid

#### Residual risk

**Key:** resid

**Type:** number

**Unit:** %

#### Residual ALE

**Key:** res_ale

**Type:** number

**Expr:** asset * ef / 100 * aro * resid / 100

**Format:** currency

#### Control cost per year

**Key:** cost

**Type:** number

**Format:** currency

#### Owner

**Key:** owner

**Type:** text

#### Target date

**Key:** due

**Type:** date

**Rows:**

**Risk:** Ransomware encrypts ERP and file servers

**Asset:** 3000000

**Ef:** 50

**Aro:** 0.15

**Treat:** Mitigate

**Resid:** 35

**Cost:** 85000

**Owner:** IT security

**Due:** 2027-03-31

**Risk:** Business email compromise redirects supplier payment

**Asset:** 400000

**Ef:** 60

**Aro:** 0.3

**Treat:** Mitigate

**Resid:** 25

**Cost:** 12000

**Owner:** Finance

**Due:** 2026-12-15

**Risk:** Engineering data theft from PLM share

**Asset:** 1800000

**Ef:** 30

**Aro:** 0.1

**Treat:** Mitigate

**Resid:** 40

**Cost:** 30000

**Owner:** Engineering IT

**Due:** 2027-02-28

**Risk:** Compromised remote vendor access to plant network

**Asset:** 1200000

**Ef:** 40

**Aro:** 0.12

**Treat:** Mitigate

**Resid:** 30

**Cost:** 22000

**Owner:** OT lead

**Due:** 2027-01-31

**Risk:** Unpatched legacy OS on a CNC controller PC

**Asset:** 250000

**Ef:** 70

**Aro:** 0.2

**Treat:** Accept

**Resid:** 100

**Cost:** 0

**Owner:** Plant manager

**Due:** 2027-06-30

**Totals:**

#### Total ALE

**Key:** ale

**Agg:** sum

**Format:** currency

#### Total residual ALE

**Key:** res_ale

**Agg:** sum

**Format:** currency

#### Total control cost

**Key:** cost

**Agg:** sum

**Format:** currency

**Summary:**

#### Annual risk reduced

**Key:** reduction

**Expr:** sum_ale - sum_res_ale

**Format:** currency

**Primary:** true

#### Net benefit after control cost

**Key:** net

**Expr:** sum_ale - sum_res_ale - sum_cost

**Format:** currency

**Primary:** true

#### Average ALE per risk

**Key:** avg_ale

**Expr:** sum_ale / count

**Format:** currency

**Notes:** Replace the example rows with your scenarios. Residual risk is the percentage of the original ALE that remains after controls, so 100 means no reduction. Review values at least twice a year and after any significant incident.

## Content

**Intro:** A risk register that stops at high, medium and low gives leadership nothing to compare. This worksheet keeps the familiar columns but adds expected annual loss before and after controls, so you can rank risks by money and show what each treatment buys.

**Sections:**

#### How to use it

**Body:** Write one row per scenario, such as ransomware on ERP or fraud through a compromised supplier mailbox. Enter the value at risk, the share lost per event and the events per year. Choose a treatment and your estimate of residual risk after controls. Add the control cost, an owner and a date. Sort or review the largest residual ALE first and export the sheet to Excel for the audit committee or insurer.

**Bullets:**

- Keep scenarios specific enough to assign one owner.
- Use ranges in notes when a value is uncertain.
- Re-score after each completed control.

#### The calculations

**Body:** SLE equals asset value times exposure factor. ALE equals SLE times events per year. Residual ALE multiplies ALE by the residual percentage. Totals add each column, and the summary shows annual risk reduced and net benefit after control costs. These are the standard quantitative risk formulas used in security management frameworks.

#### Reading the register

**Body:** Look at the residual column, not just the original. A risk with a large ALE and low residual may be well managed, while a modest ALE that you have accepted with no controls may deserve attention if its consequences include safety or regulatory exposure. Pair this register with NIST CSF or ISO 27001 control mappings if you report against those frameworks.

#### Common mistakes

**Body:** Do not double count the same loss across several rows, such as a ransomware event that also appears under backup failure. Avoid false precision: three significant digits imply certainty you do not have. Be explicit when an accepted risk has an owner and an expiry date, because accepted without review tends to become forgotten.

**Cta:** If you want the register fed from live asset and incident data instead of manual entry, Netray can discuss building that on your own infrastructure.

**Faq:**

#### Is ALE enough for a risk register?

**Answer:** It is a strong ranking tool but not complete. Add qualitative factors such as safety impact, regulatory duties and customer contract terms, because those can justify action even when the expected dollar loss looks small.

#### How do I choose residual risk?

**Answer:** Estimate the share of the original loss expectancy that remains after the planned controls, using test results or vendor evidence. If unsure, use a conservative value and revisit it after validating the control.

#### Can I use this for an ISO 27001 audit?

**Answer:** It can support the risk assessment and treatment record, but you still need your documented methodology, risk criteria and approval by management. Map rows to your Statement of Applicability controls.

#### How many risks should it contain?

**Answer:** Most programs track 15 to 40 scenarios at the enterprise level. More than that usually means scenarios are too narrow, which makes ownership and review harder.

## Search terms

cyber risk register template excel, cybersecurity risk register manufacturing, risk register with ale, it risk register template, residual risk calculation worksheet, cyber risk assessment spreadsheet, risk treatment plan template

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json