Most small business owners know they should do something about cyber risk, but few know where to begin. A risk register is a first step that costs nothing but an afternoon. If you want a plain-language primer before you start, CodeRed offers a beginner course on cybersecurity for business that covers risk profiles, mitigation, and cyber insurance basics.
What Is a Cyber Risk Register for a Small Business?
A cyber risk register is a simple table that lists what your business depends on, what could go wrong with each item, how likely and how damaging it would be, and who owns the fix. For a small business, a spreadsheet with five columns is enough to start. The goal is clear priorities, not perfect paperwork.
Larger companies often keep registers in specialized software. A small team can do the same job in a shared spreadsheet, as long as one person owns it and the team reads it on a regular schedule.
Why Build a Risk Register Before Buying More Security Tools
Many small businesses buy tools in response to the latest scary headline. That tends to leave gaps, because nobody checked which parts of the business would hurt most if they failed. A register turns a vague worry into a ranked list you can act on.
It also gives everyone a shared language. When an owner, an office manager, and an outside IT provider look at the same table, budget conversations get easier. You can point to a specific row and explain why it matters.
How to Build a Cyber Risk Register Step by Step
You need a spreadsheet, an hour of honest conversation with the people who run daily operations, and a willingness to rank things. Each step below adds one column to the table.
Step 1: List What the Business Cannot Run Without
Most guides start with an inventory of computers and software. Start with outcomes instead, and ask one question: “If this stopped tomorrow, what could we not do?” Common answers include sending invoices, taking payments, scheduling jobs, answering customer email, and reaching client records.
Then connect each answer to the system behind it. Ranking by operational stoppage, rather than by how expensive or technical a device looks, changes the order in a useful way. A shared mailbox that costs almost nothing can outrank a pricey workstation.
Step 2: Name Realistic Threats for Each Item
Stick to threats that fit a business your size. Typical examples are a staff member entering a password on a fake login page, ransomware locking a shared drive, a lost laptop, a former employee who still has access, or a vendor outage. Write each one as a plain sentence that anyone on the team could understand.
Three threats per item is plenty. A long list of unlikely scenarios makes the register harder to use and easier to ignore.
Step 3: Score Likelihood and Impact
Give each threat a likelihood score from 1 to 5 and an impact score from 1 to 5, then multiply them. A threat scored 4 for likelihood and 5 for impact lands at 20, which puts it near the top of the list. These numbers are judgment calls, so use them to compare rows against each other and not as exact measurements.
If you later want a more formal method for scoring, treating, and monitoring risk, the information security risk management course covers the identification, assessment, management, and monitoring phases in more depth at an intermediate level. The simple 1 to 5 approach is a fine place to start and teaches the same habit of thinking in likelihood and impact.
Step 4: Choose a Response and Name an Owner
Every row needs a decision. There are four common choices: reduce the risk with a control, transfer part of it through insurance, accept it because the score is low, or avoid it by stopping the risky activity. Most rows in a small business end up in the “reduce” group.
Assign each row to a named person, not to “IT” or “the team.” Add a target date next to the owner’s name. A row without an owner usually stays exactly as it was.
Step 5: Set a Review Date
Put a review on the calendar every three months. Also update the register after any real change, such as new software, a new employee, a new vendor, or an incident, even a small one. A register that nobody revisits becomes a snapshot of last year’s worries.
Example Risk Register for a Small Design Studio
The table below is a made-up illustration, not a recommendation for any specific business. It shows how the columns fit together.
| Asset | Threat | Likelihood | Impact | Score | Response | Owner |
| Shared email | Staff member enters password on a fake login page | 4 | 4 | 16 | Turn on multi-factor sign-in and send a short staff reminder | Office manager |
| Client files drive | Ransomware locks shared files | 3 | 5 | 15 | Keep a backup copy and test a restore | Studio owner |
| Laptops | Lost or stolen device | 3 | 3 | 9 | Turn on disk encryption and remote lock | Office manager |
| Invoicing software | Vendor outage | 2 | 4 | 8 | Accept the risk and keep a manual invoice template | Finance lead |
Notice that email ranks above the laptops even though the laptops cost far more. That is the point of ranking by what stops the business from operating. The cheapest items often carry the biggest operational risk.
Common Mistakes to Avoid When Starting a Risk Register
Making the First Version Too Big
Teams often try to list every system, vendor, and scenario on day one. The spreadsheet grows past the point where anyone wants to read it, and the project stalls. Start with the five to ten items the business truly depends on and add more later.
Scoring Alone
One person’s view is rarely complete. The person who handles invoices knows things about payment risk that the owner may never see. A short conversation with two or three colleagues improves the scores more than any template.
Treating the Register as Paperwork
A register that exists only to satisfy a questionnaire does not reduce risk. The value comes from the decisions it triggers, such as turning on a safeguard, testing a backup, or removing old access. If a row never leads to an action, either the score is wrong or the row does not belong.
How Cyber Insurance Fits Into a Risk Register
Insurance is one way to handle a risk, and it sits under the “transfer” option in Step 4. It can help with the financial impact of an incident, but it does not stop an incident from happening or fix the disruption that follows. Read the policy carefully for exclusions and conditions before counting on it.
Insurers often ask applicants about basic security practices. A register that already records your safeguards, owners, and review dates makes those questions easier to answer honestly. It also shows you which gaps to close before the application, not after.
What to Do After Your First Version Is Done
Share the register with whoever handles IT for the business, whether that is an employee or an outside provider. Pick the three highest scores and set a date for each response. Small, finished actions count for more than a long list of plans.
Then book the first review. When the next quarter arrives, you will have a record of what changed, what was fixed, and what still needs attention. That record is the real benefit of the register, and it grows more useful each time you update it.
