GRC work sample · Risk Assessment

SDIS Risk Register & Treatment Plan

A complete risk register for the Secure Data Information System (SDIS), a moderate-impact healthcare SaaS platform that handles PHI. Each risk is scored for likelihood and impact, mapped to NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 and SOC 2, and re-scored after treatment.

Prepared by David Benson NIST SP 800-30 methodNIST 800-53 Rev 5ISO/IEC 27001:2022SOC 2 TSC Fictional organization · sanitized data

Risk register

Select a risk to see the threat, mapped controls and treatment actions.

IDRisk scenario InherentResidualOwnerReview
Scoring key & methodology

Likelihood (1–5)

1 Rare · 2 Unlikely · 3 Possible · 4 Likely · 5 Almost certain

Impact (1–5)

1 Negligible · 2 Minor · 3 Moderate · 4 Major · 5 Severe (PHI breach, major outage, regulatory harm)

Risk bands (L × I)

Low 1–4 Monitor / accept with review
Medium 5–9 Plan treatment; track to closure
High 10–14 Prioritized treatment
Critical 15–25 Immediate action; escalate

Treatment strategies

Mitigate — add controls to reduce likelihood or impact
Transfer — insurance, outsourcing, contract
Avoid — stop or change the activity
Accept — formally retain with sign-off

Mappings

Principal correspondences per NIST's 800-53↔ISO 27001 crosswalk and AICPA's TSC↔800-53 mapping.