Compliance & ContractsFree worksheetPDF, Excel, Word exportManufacturing

Cyber Risk Register Worksheet with ALE Totals

A risk register that stops at high, medium and low gives leadership nothing to compare. This worksheet keeps the familiar columns but adds expected annual loss before and after controls, so you can rank risks by money and show what each treatment buys.

Download:

SLE	ALE	Residual ALE
$1,500,000	$225,000	$78,750
$240,000	$72,000	$18,000
$540,000	$54,000	$21,600
$480,000	$57,600	$17,280
$175,000	$35,000	$35,000

Total ALE

$443,600

Total residual ALE

$170,630

Total control cost

$149,000

Annual risk reduced

$272,970

Net benefit after control cost

$123,970

Average ALE per risk

$88,720

Replace the example rows with your scenarios. Residual risk is the percentage of the original ALE that remains after controls, so 100 means no reduction. Review values at least twice a year and after any significant incident.

Risk register review

Optional review of your scenarios and ALE assumptions.

Optional. The tool and every export work without this. No spam.

How to use it

Write one row per scenario, such as ransomware on ERP or fraud through a compromised supplier mailbox. Enter the value at risk, the share lost per event and the events per year. Choose a treatment and your estimate of residual risk after controls. Add the control cost, an owner and a date. Sort or review the largest residual ALE first and export the sheet to Excel for the audit committee or insurer.

Keep scenarios specific enough to assign one owner.
Use ranges in notes when a value is uncertain.
Re-score after each completed control.

The calculations

SLE equals asset value times exposure factor. ALE equals SLE times events per year. Residual ALE multiplies ALE by the residual percentage. Totals add each column, and the summary shows annual risk reduced and net benefit after control costs. These are the standard quantitative risk formulas used in security management frameworks.

Reading the register

Look at the residual column, not just the original. A risk with a large ALE and low residual may be well managed, while a modest ALE that you have accepted with no controls may deserve attention if its consequences include safety or regulatory exposure. Pair this register with NIST CSF or ISO 27001 control mappings if you report against those frameworks.

Common mistakes

Do not double count the same loss across several rows, such as a ransomware event that also appears under backup failure. Avoid false precision: three significant digits imply certainty you do not have. Be explicit when an accepted risk has an owner and an expiry date, because accepted without review tends to become forgotten.

Frequently Asked Questions

Is ALE enough for a risk register?

It is a strong ranking tool but not complete. Add qualitative factors such as safety impact, regulatory duties and customer contract terms, because those can justify action even when the expected dollar loss looks small.

How do I choose residual risk?

Estimate the share of the original loss expectancy that remains after the planned controls, using test results or vendor evidence. If unsure, use a conservative value and revisit it after validating the control.

Can I use this for an ISO 27001 audit?

It can support the risk assessment and treatment record, but you still need your documented methodology, risk criteria and approval by management. Map rows to your Statement of Applicability controls.

How many risks should it contain?

Most programs track 15 to 40 scenarios at the enterprise level. More than that usually means scenarios are too narrow, which makes ownership and review harder.

If you want the register fed from live asset and incident data instead of manual entry, Netray can discuss building that on your own infrastructure.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Compliance & Contracts tools

See all

Back to All Tools