Field notes from security operations and the audit room.

The risk register that survives an audit, and the one that does not

ENISA sets out seven things a risk treatment entry has to carry. Most registers written by an SME carry three. The gap is not paperwork, it is the part an auditor reads first and the part that decides whether the rest of your evidence is believed.

Daniel Grigorovich · Founder