Risk Register (Where to look for risks)

It serves as a main point of reference for every risk-related action (for example, risk
prioritization and response). A security expert should be able to trace and subsequently
document all identified risks. The creation of an IT risk register will itemize each risk found.

The search for potential threats and vulnerabilities should not be limited to the IT
infrastructure – its scope should be broad enough to include all people and processes directly
or indirectly associated with IT assets. Usual places to look for identifying risks are: audit
reports, incident management, public media, annual reports, press releases, vulnerability
assessments / penetration tests, business continuity / disaster recovery plans, interviews and
workshops, and threat intelligence services.