Risk Register Configurator

This tool lets you build a custom risk configuration file for your organisation. The configuration is saved as a JSON file and used by the Risk Assessor application to evaluate security risks for any system or project.

You do not need to be a security expert to use this tool. Everything has sensible defaults. You only need to change what is relevant to your organisation.

The configurator ships with a library of 77 pre-built risks organised across:

The configurator and the risk assessor work together. Think of this tool as the setup phase — you define the rules once, then the assessor applies them every time a system is evaluated.

When you save a configuration, the JSON file contains two things:

• Raw overrides — only the values you changed (small, clean, reloadable into this configurator)
• Resolved data block — the complete, fully merged dataset ready for the risk assessor to use directly

Work through the steps in order. You can save at any point and continue later — the ↓ Save Config button is always in the top bar.

Click ↓ Save Config in the top bar at any time. The browser downloads a JSON file named risk-register-<label>-<date>.json. This file can be loaded back into the configurator or passed directly to the risk assessor.

Click ↑ Open Config and pick a JSON file you previously saved. All your customisations are restored across every tab — even tabs you haven't visited yet will be updated in the background.

Click ↺ Reset to clear all changes and return to the shipped defaults. You'll be asked to confirm first.

The Risk Register shows all 77 risks as a colour-coded grid. Columns are risk families; rows are lifecycle periods. Each cell is one risk.

Tiles with an amber outline have been modified from the default values.

Some risks in the library may not be relevant to your organisation at all (e.g. IoT risks if you only assess business applications). Rather than leaving them in the register with a low score, you can deactivate them entirely.

1. Click any tile to open the editor.
2. Click ⛔ Deactivate in the footer (bottom-left of the editor).
3. The tile immediately turns grey with a strikethrough name and an ⛔ Inactive label.
4. The risk is excluded from all assessments, surveys, and control mappings across every tab instantly.

Double-click any column header (family) or row header (period) to rename it. Useful if your organisation uses different terminology.

Scoping questions let the assessor narrow down which risks apply to a specific system. Each question has a list of risks it can switch off when the assessor answers No (meaning that feature or context doesn't apply).

Example: "Does the system include any AI functionality?" — If No, all AI-related risks (AIQ, AIA families) are suppressed for that assessment.

1. Read through the question list.
2. Toggle Inactive any questions that will never apply to the type of system being assessed (e.g. IoT questions if you only assess business applications).
3. Leave the rest Active — the assessor will answer them per system.

The right-hand panel shows which risks are affected by each question. Greyed-out risks are currently suppressed by an inactive question.

The Vendor Survey is a set of questions about the supplier's security practices. The assessor fills in answers (Yes / No / Partial / N/A), and each answer contributes a weighted score to the linked risks.

The Internal Survey assesses your own organisation's security maturity — controls in place, processes followed, and capabilities available. It works exactly the same as the Vendor Survey but focuses inward rather than at a third party.

All editing is the same: question text, weights, per-answer scores, and active/inactive toggle.

Controls are security measures linked to specific risks. When an assessor rates a control as implemented (Yes / Partial), it reduces the effective risk score for its linked risks. When a control is absent (No), it may increase the risk score.

Click any control to see which risks it is linked to. Click a risk in the map panel to highlight the controls that cover it. This helps you identify gaps — risks with no active controls need extra attention.

The Risk Matrix tab controls how a likelihood score and an impact score are combined into a risk rating. It has four sections.

If you have an independent security rating for your vendor, enter it here. The rating is converted to a multiplier between ×0.80 and ×1.20 that scales the final risk score up or down:

Supported rating sources: BitSight (scale 250–900), Panorays (0–100), UpGuard (0–950), Manual (1–10 score you assign yourself). Select No use to disable TPRA (multiplier = ×1.00).

The grid maps a likelihood band (column) against an impact band (row) to produce a risk score (1–100). Click any cell to edit its score directly. The risk score calculator below updates live as you make changes.

Defines the cut-off points for LOW / MEDIUM / HIGH / EXTREME ratings. Edit the From value of any band; the To value is calculated automatically. Tighten the bands to be more sensitive (more risks rate HIGH), or widen them to be more forgiving.

The five bands for likelihood (Rare → Almost Certain) and impact (Insignificant → Catastrophic). Edit the From value to adjust where each band starts. Band names can also be changed to match your organisation's risk language.

Enter any likelihood and impact value (1–100) to instantly see which bands they map to and what risk rating results. Use this to validate your matrix configuration.

The risk assessor can send completed assessment data to an AI model for analysis, summary, or recommendations. The text you write here becomes the system prompt — the set of instructions given to the AI before it sees the assessment data.

A good AI prompt tells the model: who it is, what format to respond in, what tone to use, and what to look for in the data.

• Use Reset to Default to restore the shipped prompt at any time.
• Use Copy to Clipboard to copy the current prompt for use elsewhere.
• The prompt is saved as part of the JSON config and loaded back automatically.

The saved JSON file uses schema version 1.4. It has two layers: raw delta overrides (for round-trip reloading into this configurator) and a fully resolved resolved block ready for the assessor to consume.

A 5×5 nested array. matrix[impactIndex][likelihoodIndex] where index 0 = lowest band, 4 = highest. Each cell: { pts: number } — the risk points (1–100) for that combination.

Each risk has a Base Score (inherent severity) and a Strategy Adjustment (context amplification):

Example: Base 7.0, Strategy 25% → 7.0 × 1.25 = 8.75

The assessor enters a Likelihood score (1–100) and an Impact score (1–100) for each risk. These are mapped to one of five bands each, and the 5×5 matrix cell at that intersection gives the risk points.

If TPRA is set to No use or Not set, the multiplier is 1.00 and the score is unchanged.

The adjusted score is mapped against resolved.scoreBands to produce the final rating: LOW MEDIUM HIGH EXTREME

Compare the final score (or band ordinal) against the risk's appetite value. Flag the risk if it exceeds the threshold. Surface these as priority items in the report.

Vendor survey, internal survey, and control scores are collected per risk through their linked IDs. For each risk, sum the weighted scores from linked active questions/controls to produce a coverage score. This can be used to adjust the likelihood or impact score before the matrix lookup — for example: high vendor survey score → lower likelihood, strong controls → lower impact.