Compliance & ContractsFree worksheetPDF, Excel, Word exportDiscrete Manufacturing

Cyber Risk Register Worksheet for Manufacturers

A risk register turns vague cyber worry into a ranked list with owners and dates. This worksheet scores each risk on likelihood and impact, applies control effectiveness to give a residual score, and shows where treatment is overdue.

Download:

Risk	Asset or area	Likelihood (1-5)	Impact (1-5)	Inherent score	Control effectiveness (0-100) (%)	Residual score	Treatment	Owner	Next review
				20		9
				12		7.2
				12		6
				12		4.8
				10		5.5

Risks recorded

Highest inherent score

Highest residual score

Average residual score

6.5

Average risk reduction from controls

50.8%

Scores 15 to 25 are usually treated as high, 8 to 14 medium, below 8 low. Control effectiveness is a judgement, so record the evidence behind it elsewhere.

Pressure test your top five risks

Optional review of scores and controls for your highest ranked cyber risks.

Optional. The tool and every export work without this. No spam.

How to use the register

List risks as short cause and effect statements tied to an asset, such as 'HMI PCs reachable from office network'. Score likelihood and impact from 1 to 5 using a scale agreed with plant leadership. Estimate how effective current controls are, pick a treatment and assign an owner and review date.

Write risks as events, not generic threats
Use one scale across IT and OT
Give every risk exactly one owner
Review the top risks every month

How scores are calculated

Inherent score is likelihood times impact. Residual score reduces that by control effectiveness, so 4 by 5 at 55 percent effective gives a residual of 9. This is a simple method, in line with ISO 27005 style qualitative assessment. It is a ranking aid, not a prediction of loss.

Plant specific risks to include

Add OT items that office registers miss: unsupported operating systems on machine PCs, flat networks, vendor remote tools, loss of CNC programs, ERP downtime during shipping peaks, and loss of traceability records. Rate impact in production hours and customer penalties, not only data loss.

Common mistakes

Rating everything medium, scoring controls by what is planned rather than in place, leaving owners blank, and never revisiting the register after incidents or audits.

Frequently Asked Questions

What scale should we use?

A five by five matrix is common. Define each level in plain terms, for example impact 5 meaning plant stopped over a week or major customer loss, so different people score consistently.

How is residual risk different from inherent?

Inherent risk assumes no controls. Residual risk is what remains after controls that actually work. Both are useful: inherent shows what you depend on, residual shows what to fix next.

Who owns a risk?

A manager with authority to fund or change the response, such as the IT director, plant manager or controller. IT security facilitates the register but should not own every risk.

How often should it be reviewed?

Top risks monthly, the full register at least twice a year, and after any major incident, acquisition, ERP project or new plant.

If you want the register fed by real ERP, asset and patch data, we can discuss it. The worksheet is complete on its own.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Compliance & Contracts tools

See all

Back to All Tools