RSK-02 · Risk and Decisions
Risk register with owners and treatment
Risks are recorded with inherent and residual judgment, an owner, a treatment decision and a review date.
6frameworks fully address it
1partially
1leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC3.4
- ISO 27001Full6.1.3
- NIST CSFFullID.RA-05
- PCI DSSPartial12.3.1 Targeted risk analyses only, not an enterprise register.
- HIPAAFull164.308(a)(1)(ii)(B)
- GDPRAbsent No register of organizational risk is required; Art. 30 requires a record of processing activities, which is a different artifact.
- EU AI ActFullArt. 9(2)
- NIST AI RMFFullMANAGE 1.3
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Risk register, treatment plans, review evidence.
?Why it exists
A register nobody owns is a list.
For a smaller organizationA spreadsheet reviewed quarterly by the leadership team.