# Cyber Risk Register Worksheet for Manufacturers

> Source: https://netray.co/tools/cyber-risk-register-worksheet-for-manufacturers
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Score IT and OT cyber risks by likelihood and impact, compare inherent and residual risk and track the treatment owner.

## Category

compliance-legal

## Industry

Discrete Manufacturing

## Audience

- IT security lead
- CISO
- Risk manager
- Plant manager

## Tool

**Kind:** worksheet

**Mode:** editable

**Columns:**

#### Risk

**Key:** risk

**Type:** text

#### Asset or area

**Key:** asset

**Type:** text

#### Likelihood (1-5)

**Key:** like

**Type:** number

#### Impact (1-5)

**Key:** impact

**Type:** number

#### Inherent score

**Key:** inherent

**Type:** number

**Expr:** like * impact

**Format:** integer

#### Control effectiveness (0-100)

**Key:** control_eff

**Type:** number

**Unit:** %

#### Residual score

**Key:** residual

**Type:** number

**Expr:** like * impact * (1 - clamp(control_eff, 0, 100) / 100)

**Format:** decimal

#### Treatment

**Key:** treatment

**Type:** select

**Options:**

- Mitigate
- Transfer
- Accept
- Avoid

#### Owner

**Key:** owner

**Type:** text

#### Next review

**Key:** review

**Type:** date

**Rows:**

**Risk:** Ransomware encrypts ERP and file servers

**Asset:** Data center

**Like:** 4

**Impact:** 5

**Control eff:** 55

**Treatment:** Mitigate

**Owner:** IT director

**Review:** 2026-12-15

**Risk:** Unpatched HMI PCs reachable from office network

**Asset:** Plant floor cells

**Like:** 3

**Impact:** 4

**Control eff:** 40

**Treatment:** Mitigate

**Owner:** OT lead

**Review:** 2026-12-15

**Risk:** Vendor remote access credentials stolen

**Asset:** Machine tools

**Like:** 3

**Impact:** 4

**Control eff:** 50

**Treatment:** Mitigate

**Owner:** IT security

**Review:** 2027-01-20

**Risk:** Phishing leads to payment fraud

**Asset:** Finance

**Like:** 4

**Impact:** 3

**Control eff:** 60

**Treatment:** Transfer

**Owner:** Controller

**Review:** 2027-01-20

**Risk:** Engineering data leaked by departing user

**Asset:** PLM and CAD vault

**Like:** 2

**Impact:** 5

**Control eff:** 45

**Treatment:** Mitigate

**Owner:** Engineering manager

**Review:** 2027-02-10

**Totals:**

#### Risks recorded

**Key:** risk

**Agg:** count

#### Highest inherent score

**Key:** inherent

**Agg:** max

**Format:** integer

#### Highest residual score

**Key:** residual

**Agg:** max

**Format:** decimal

**Summary:**

#### Average residual score

**Key:** avg_res

**Expr:** avg_residual

**Format:** decimal

#### Average risk reduction from controls

**Key:** avg_red

**Expr:** if(gt(avg_inherent, 0), (1 - avg_residual / avg_inherent) * 100, 0)

**Format:** percent

**Notes:** Scores 15 to 25 are usually treated as high, 8 to 14 medium, below 8 low. Control effectiveness is a judgement, so record the evidence behind it elsewhere.

## Content

**Intro:** A risk register turns vague cyber worry into a ranked list with owners and dates. This worksheet scores each risk on likelihood and impact, applies control effectiveness to give a residual score, and shows where treatment is overdue.

**Sections:**

#### How to use the register

**Body:** List risks as short cause and effect statements tied to an asset, such as 'HMI PCs reachable from office network'. Score likelihood and impact from 1 to 5 using a scale agreed with plant leadership. Estimate how effective current controls are, pick a treatment and assign an owner and review date.

**Bullets:**

- Write risks as events, not generic threats
- Use one scale across IT and OT
- Give every risk exactly one owner
- Review the top risks every month

#### How scores are calculated

**Body:** Inherent score is likelihood times impact. Residual score reduces that by control effectiveness, so 4 by 5 at 55 percent effective gives a residual of 9. This is a simple method, in line with ISO 27005 style qualitative assessment. It is a ranking aid, not a prediction of loss.

#### Plant specific risks to include

**Body:** Add OT items that office registers miss: unsupported operating systems on machine PCs, flat networks, vendor remote tools, loss of CNC programs, ERP downtime during shipping peaks, and loss of traceability records. Rate impact in production hours and customer penalties, not only data loss.

#### Common mistakes

**Body:** Rating everything medium, scoring controls by what is planned rather than in place, leaving owners blank, and never revisiting the register after incidents or audits.

**Cta:** If you want the register fed by real ERP, asset and patch data, we can discuss it. The worksheet is complete on its own.

**Faq:**

#### What scale should we use?

**Answer:** A five by five matrix is common. Define each level in plain terms, for example impact 5 meaning plant stopped over a week or major customer loss, so different people score consistently.

#### How is residual risk different from inherent?

**Answer:** Inherent risk assumes no controls. Residual risk is what remains after controls that actually work. Both are useful: inherent shows what you depend on, residual shows what to fix next.

#### Who owns a risk?

**Answer:** A manager with authority to fund or change the response, such as the IT director, plant manager or controller. IT security facilitates the register but should not own every risk.

#### How often should it be reviewed?

**Answer:** Top risks monthly, the full register at least twice a year, and after any major incident, acquisition, ERP project or new plant.

## Search terms

cyber risk register template excel, cybersecurity risk register manufacturing, OT risk register template, information security risk register, cyber risk assessment worksheet, risk register likelihood impact score, ISO 27001 risk register template, residual risk worksheet

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json