C6.1 Open risk register

NIST IR 8286 and schemas [9]

The first component of L6 requires that the register be kept in the open schema of the register series [9]: eleven fields per row, a detail record behind each row with three exposure snapshots, inherent, expected and measured, with the planned and the actual cost of the response, the source of the information and the follow-up; a roll-up from system to organization to enterprise by the tier each row declares; and export and import in the published format. Chapter 13 described the schema; this component adopts it and adds the framework's own fields, the taxonomy node, the tier, the validated statement, the precision and the opportunity flag, as extensions that leave the base record valid.

The component reconciles the register with everything upstream of it. The eleven fields are where L1's category, L2's statement, L3's likelihood and consequence and L4's response, cost and owner come to rest, and the three snapshots are where chapter 11's second cluster becomes columns. Inherent exposure is before any control; expected exposure is what the response was meant to achieve, and it is the figure the selection report of C4.5 wrote down; measured exposure is what the controls actually achieved, and it is the figure C5.5 compares with the second. Residual, the word most registers use, is retired because it names both the second and the third snapshot and so hides the one comparison that matters. The planned and actual cost pair does for the response what the exposure pair does for the control: it asks whether the decision was the right one, not only whether it was carried out.