Skip to content
Security Risk Templates by SRMBOK

Practical security risk guidance, worked examples and templates.

  • Articles
  • SRMBOK
  • RMBOK
  • Articles
  • SRMBOK
  • RMBOK

Category: Plan & treat

How Do I Build My First Risk Register?

Build a register people can use: Describe the risk; Name controls and owners; Agree the next action.

Start building a risk register from first principles, with the minimum field set that works and a free starter template to get you moving fast.

How Do I Record Security Risks So Someone Can Act on Them?

Write risk records that prompt action: A clear risk statement; Controls with evidence; An owner and next review.

A free security risk register template with the fields that matter most: risk ID, consequence, likelihood, control evaluation and prioritisation.

How Do I Compare Risk Before and After a Treatment?

Separate today’s risk from the target: Record current controls; Assess current exposure; Test the proposed treatment.

Recording pre and post mitigation risk as separate, dated fields lets you verify whether a treatment actually worked, not just claim it did.

How Do I Turn Risk Treatments into an Accountable Schedule?

Turn treatments into commitments: A defined action; One accountable owner; A due date and evidence.

A free risk treatment schedule template covering treatment options, cost-benefit, ownership, timeline and the accept/reject decision, in one document.

How Do I Make a Risk Treatment Plan People Will Keep Updated?

Keep the treatment plan updateable: What will change?; Who acts, and by when?; How will it be checked?.

A simple six-column risk treatment plan template people actually keep updated, replacing the complex schedule everyone quietly stops maintaining.

How Do I Write a Security Plan People Can Implement?

Write a security plan people can implement: Explain the objectives; Specify roles and controls; Set response and review arrangements.

How to write a security plan using an eight-section structure, from statement of purpose through SMART objectives to residual risk and timetable.

Which Fields Do I Actually Need in a Risk Register?

Keep the fields that support decisions: Risk and consequence; Controls and assessment; Owner, action and review.

The minimum risk register fields that actually work in practice, why more columns usually make a register worse, and a simple starter set to copy.

Security Risk Templates by SRMBOK

Practical security risk guidance, worked examples and templates.

  • About
  • Privacy

All rights reserved