# Manufacturing IT Risk Register Worksheet > Source: https://netray.co/tools/manufacturing-it-risk-register-worksheet > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Track infrastructure, ERP and OT risks with a likelihood times impact score, residual score after treatment and a named owner. ## Category compliance-legal ## Industry Discrete Manufacturing ## Audience - IT manager - CIO - Security officer ## Tool **Kind:** worksheet **Mode:** editable **Columns:** #### Risk **Key:** risk **Type:** text #### Category **Key:** category **Type:** select **Options:** - Availability - Security - Data loss - Vendor - Compliance - People #### Likelihood (1-5) **Key:** likelihood **Type:** number #### Impact (1-5) **Key:** impact **Type:** number #### Inherent score **Key:** score **Type:** number **Expr:** likelihood * impact **Format:** integer #### Treatment **Key:** treatment **Type:** text #### Residual likelihood **Key:** residual_l **Type:** number #### Residual score **Key:** residual **Type:** number **Expr:** residual_l * impact **Format:** integer #### Owner **Key:** owner **Type:** text #### Next review **Key:** review **Type:** date **Rows:** **Risk:** Single ERP database host with no standby **Category:** Availability **Likelihood:** 3 **Impact:** 5 **Treatment:** Add replica and tested restore **Residual l:** 2 **Owner:** IT manager **Review:** 2027-01-15 **Risk:** Ransomware via vendor remote access **Category:** Security **Likelihood:** 3 **Impact:** 5 **Treatment:** Jump host, MFA, session recording **Residual l:** 2 **Owner:** Security officer **Review:** 2026-12-01 **Risk:** Backups stored on same network as production **Category:** Data loss **Likelihood:** 2 **Impact:** 5 **Treatment:** Immutable offsite copy **Residual l:** 1 **Owner:** Infrastructure lead **Review:** 2026-12-15 **Risk:** Unsupported operating system on CNC controller PCs **Category:** Compliance **Likelihood:** 4 **Impact:** 3 **Treatment:** Isolate cells and plan replacement **Residual l:** 3 **Owner:** Controls engineer **Review:** 2027-02-01 **Risk:** One person knows the ERP integrations **Category:** People **Likelihood:** 3 **Impact:** 4 **Treatment:** Document and cross-train **Residual l:** 2 **Owner:** ERP administrator **Review:** 2026-11-30 **Totals:** #### Average inherent score **Key:** score **Agg:** avg **Format:** decimal #### Average residual score **Key:** residual **Agg:** avg **Format:** decimal #### Highest inherent score **Key:** score **Agg:** max **Format:** integer **Summary:** #### Average score reduction from treatment **Key:** reduction **Expr:** avg_score - avg_residual **Format:** decimal **Notes:** Scores of 15 or more are commonly treated as high and need executive visibility; define your own thresholds in policy. Use consistent 1 to 5 definitions across reviewers. ## Content **Intro:** A risk register is the list your CIO and auditors ask for first. This worksheet keeps IT and OT risks in one place with an automatic score, a treatment and a residual score so priorities are visible. **Sections:** #### How to use the register **Body:** Add one row per risk written as a cause and effect, not a vague topic. Rate likelihood and impact from 1 to 5 using agreed definitions, then describe the treatment, set the expected residual likelihood and assign an owner and review date. The score columns calculate automatically, and the summary shows how much the planned treatments reduce average exposure. Export to Excel for committee packs. #### Scoring method **Body:** The inherent score is likelihood multiplied by impact, giving 1 to 25. Residual score uses the expected likelihood after treatment with the same impact, a simplification that is common in practice. Define the scale in plain terms: for impact, tie levels to hours of plant downtime, scrap, safety consequence or contractual penalty, so different reviewers rate consistently. **Bullets:** - Likelihood 1 means rare, 5 means expected within the year - Impact 1 means minor inconvenience, 5 means plant stop or safety event - Review high scores monthly and others quarterly #### Manufacturing-specific risks **Body:** Typical entries include unsupported operating systems on machine controllers, flat networks between office and cells, single points of failure in ERP and MES, vendor remote access, long hardware lead times for replacements, and dependency on a few key staff. Frameworks such as IEC 62443 and NIST CSF can provide structure, but the register should stay readable by plant management. #### Common mistakes **Body:** Registers decay when no one owns reviews, when every risk is rated medium, or when treatments have no due date. Do not list controls as risks. Close risks with evidence, and keep accepted risks on the list with the name of the executive who accepted them. **Cta:** Netray can discuss how private AI over your tickets and documentation might help surface candidate risks for review, with people deciding the ratings. **Faq:** #### What score counts as a high risk? **Answer:** There is no universal threshold. Many organizations treat 15 to 25 on a 5 by 5 scale as high, 8 to 14 as medium and below 8 as low. Set your thresholds in policy and apply them consistently. #### How many risks should a register hold? **Answer:** Enough to cover your material exposures, often 20 to 60 for a plant or small company. A very long list is hard to maintain. Group similar items and keep owners accountable for each. #### Should OT and IT risks share one register? **Answer:** Using one register helps leadership see total exposure. Tag the category and owner so OT items route to controls engineering. Impact definitions must include safety and production for OT items. #### What is the difference between inherent and residual risk? **Answer:** Inherent risk is the exposure before planned treatments, residual is what remains after they work. Residual is an estimate until the treatment is verified, so update it only once evidence exists. ## Search terms IT risk register template, IT risk register excel, risk register manufacturing, cybersecurity risk register template, infrastructure risk assessment spreadsheet, risk matrix likelihood impact template, ERP risk register, OT IT risk register --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json