Build a Cybersecurity Risk Register

Build an Excel risk register with NIST CSF 2.0 traceability and priorities.

Introduction

30 Second Summary

Small businesses often carry security worries in emails, meeting notes, or people's heads. Leaders struggle to decide what needs attention first when every concern sounds urgent.

In this project, you will build a cybersecurity risk register for Northstar Retail in Microsoft Excel using NIST CSF 2.0. The finished workbook turns five security concerns into prioritized actions with named owners.

What You'll Build

When you finish, you can open one workbook in front of a decision-maker to show the three highest risks with their owners and next actions.

By the end of this project, you'll have:

A five-item risk register that shows each security concern beside its current safeguard.
A repeatable exposure score that makes the highest priorities visible through data bars and a descending sort.
An executive risk summary that connects the top three risks to accountable owners and recommended actions.
A Secret Mission: Estimate residual exposure after the planned safeguards and compare it with current exposure.

Are there any prerequisites?

You need Microsoft Excel desktop on a Windows device. No prior cybersecurity governance experience is required.

Before We Start

Before any hands-on work begins, take a moment to connect the workbook to the decisions it supports. Your explanation will clarify how a risk register helps business leaders understand which cybersecurity concerns need attention first.

Set Up the Excel Workbook

You have already connected a cybersecurity risk register to business decisions. Now it needs one dependable file so every later risk decision has a single place to live.

Microsoft Excel is already available on your Windows device. This step creates the saved workbook that holds the rest of the project.

In this step, get ready to:

Create a blank Excel workbook.
Save the workbook locally as Northstar_Retail_GRC_Risk_Register.xlsx.
Confirm that the saved workbook accepts data in cell A1.

Create a blank workbook

A blank workbook gives the register an empty grid. Each later risk becomes one row in that grid.

Press the Windows key to open the Windows search bar.
Type Excel and press Enter to open it.
Select Blank workbook from the Excel start screen.

You'll see an empty worksheet made of labelled columns and numbered rows. Cell A1 sits at the top-left corner.

Save the project file

Saving now gives the register a stable local file before you add more information. Every later change stays attached to the same workbook.

Press Ctrl+S to open the save options.
Choose a local folder that you can find again.
Enter Northstar_Retail_GRC_Risk_Register in the File name box.
Select Save.

That is the foundation in place: your workbook now has a stable local home. You'll see Northstar_Retail_GRC_Risk_Register in the Excel title bar.

Workbook name still missing?

The workbook may still be waiting for a save location. Press Ctrl+S again to return to the save options.

Choose a local folder before entering the workbook name in the File name box.

Help me save the workbook locally in Excel.

Confirm data entry and saving

The first register field proves that the worksheet accepts data. Saving it also confirms that your workbook keeps the change.

Select cell A1.
Type Risk ID.
Press Enter.

Before the final save, do you think the workbook name and the value in A1 will both remain visible?

Save the workbook by pressing Ctrl+S.

You'll see Northstar_Retail_GRC_Risk_Register in the Excel title bar. Cell A1 will still display Risk ID.

Workbook name or Risk ID missing?

Select cell A1 if Risk ID appears in a different cell.
Type Risk ID in A1 if the cell is blank.
Press Ctrl+S again if the title bar does not show the saved workbook name.

Help me check why my Excel workbook name or cell A1 is incorrect.

✔️ Awesome, I've got everything!

Great. Double check that the workbook is saved before moving on.

ⓧ I'd like to double check the full code

Your local workbook file should be named Northstar_Retail_GRC_Risk_Register.xlsx.

The active worksheet should have Risk ID in cell A1. Every other cell should be blank.

Your workbook now has a stable home and its first register field. Next, you'll turn the empty worksheet into a five-item cybersecurity risk register.

Capture the Retailer's Cyber Risks

Your saved Microsoft Excel workbook gives Northstar Retail one reliable place for its security concerns. A risk register turns those concerns into records that leaders can review.

Scattered risks are hard to compare. This step turns those concerns into a visible set of records. You then test what business decision the plain list can support.

In this step, get ready to:

Add the thirteen fields that structure the risk register.
Enter five fictional risks with their current safeguards.
Convert the completed range into a filterable Excel table.

Add the register fields

Every risk needs the same structure before anyone can compare the records. The header row creates that shared structure.

Select cell B1 in the active worksheet.
Fill cells B1:M1 by pasting the tab-separated header row below:

Risk Description	Likelihood	Impact	Exposure Rating	Current Safeguard	Risk Response	Risk Owner	NIST CSF Outcome	Current Profile	Target Profile	Action Plan	Target Timeframe

What do these fields capture?

The opening fields describe the risk.
The rating fields hold numeric assessments.
The Current Safeguard field records the protection already in place.
The framework fields reserve room for a later NIST CSF 2.0 mapping.
The final fields capture follow-up work.

Save Northstar_Retail_GRC_Risk_Register.xlsx by pressing Ctrl+S.
Scan row 1 from cell A1 through cell M1.

You should see Risk ID in cell A1. You should see Target Timeframe in cell M1.

Did the headers stay in one cell?

Select cell B1 before pasting the header row.
Copy the tab-separated row directly from the code block.
Confirm that the final header reaches cell M1.

If the headers still do not spread across the row, help me place tab-separated headers into separate Excel cells.

Enter the fictional risk scenarios

A useful risk statement connects a possible event to the weakness that makes it plausible. A current safeguard records what Northstar Retail already relies on today.

Select cell A2.
Fill rows 2 through 6 by pasting the tab-separated risk data below:

R-001	Staff may submit credentials after a phishing message because awareness training is informal.				Spam filtering and occasional email reminders
R-002	Former employee accounts may retain access because offboarding reviews are manual.				Manual manager offboarding request
R-003	Attackers may exploit unrecorded storefront vulnerabilities because vulnerability reviews are ad hoc.				Hosting provider patches its platform, but application findings are not recorded
R-004	Ransomware may cause a prolonged outage because backups are not restore-tested.				Nightly backups with no documented restore test
R-005	Incident impact may grow because response roles with hosting and payment providers are not coordinated.				Staff call the IT manager informally

How is the risk data arranged?

The tab spacing places each Risk ID in column A. It places each description in column B.

The same spacing places each current safeguard in column F. Columns C:E remain blank.

Columns G:M also remain blank. Later steps use those fields for decisions that the plain risk list cannot support.

Save the workbook by pressing Ctrl+S.
Check cells A2:A6 for the five Risk IDs.
Check cells F2:F6 for the five current safeguards.

You should see Risk IDs from R-001 through R-005. Each row should show its description beside a safeguard in column F.

Did the risk data shift into the wrong columns?

Clear the misplaced values from cells A2:F6.
Select cell A2 again.
Paste the complete tab-separated block in one action.

If the descriptions or safeguards still land in the wrong columns, help me fix my pasted Excel risk data.

Turn the range into a table

An Excel table groups the range into one structured register. Its header controls make each field easier to filter.

Selecting thirteen columns can feel fiddly. Keeping the selection inside A1:M6 protects the blank fields.

Drag from cell A1 to cell M6 to select the complete range.
Press Ctrl+T.
Confirm that My table has headers is checked.
Select OK.
Save the workbook by pressing Ctrl+S.

Before you inspect the finished register, do you think this plain table can identify which risk deserves action first?

Select any cell inside A1:M6.
Check the header row for filter buttons.
Count the Risk IDs in column A.
Try to identify the highest-priority risk using only the visible evidence.

You should see filter buttons across the header row. You should also see five Risk IDs from R-001 through R-005.

The Likelihood, Impact, and Exposure Rating columns remain blank. The table therefore gives you no consistent basis for choosing the first risk to address.

You have captured Northstar Retail's security concerns in one working register. That intended shortfall now gives the next step a clear job.

Do not see filter buttons?

Select the entire range from A1 through M6 again.
Press Ctrl+T again.
Confirm that My table has headers is checked.
Select OK.

If the range still does not become a table, help me troubleshoot my Excel table creation.

✔️ Awesome, I've got everything!

Your saved table contains all thirteen headers. It also contains five risk records with blank assessment fields.

ⓧ I'd like to double check the full register

Compare the table in Northstar_Retail_GRC_Risk_Register.xlsx with this complete tab-separated reference:

Risk ID	Risk Description	Likelihood	Impact	Exposure Rating	Current Safeguard	Risk Response	Risk Owner	NIST CSF Outcome	Current Profile	Target Profile	Action Plan	Target Timeframe
R-001	Staff may submit credentials after a phishing message because awareness training is informal.				Spam filtering and occasional email reminders							
R-002	Former employee accounts may retain access because offboarding reviews are manual.				Manual manager offboarding request							
R-003	Attackers may exploit unrecorded storefront vulnerabilities because vulnerability reviews are ad hoc.				Hosting provider patches its platform, but application findings are not recorded							
R-004	Ransomware may cause a prolonged outage because backups are not restore-tested.				Nightly backups with no documented restore test							
R-005	Incident impact may grow because response roles with hosting and payment providers are not coordinated.				Staff call the IT manager informally

How to read this reference

Each line represents one worksheet row. The empty tab positions preserve the blank fields in columns C:E and G:M.

Your retailer's five risks are now visible in one filterable table. Next up, you will calculate exposure so the register can show which risks need attention first.

Score and Prioritize the Risks

The risk register now makes five concerns visible in Microsoft Excel. Its current order gives a leader no consistent way to decide which risk deserves attention first.

A shared likelihood and impact rubric turns each concern into a comparable exposure rating. This step makes those ratings visible before sorting the table from highest to lowest.

In this step, get ready to:

Score each risk with the project likelihood and impact rubric.
Calculate a repeatable exposure rating for every risk.
Prioritize the risk register by exposure.

Apply the scoring rubric

Likelihood represents how plausible each fictional scenario is. Impact represents how serious the business effect could be.

Select cell C2 in the Likelihood column.
Fill C2:D6 by copying the values below into C2:

How the Scoring Rubric Works

Likelihood runs from 1 for Rare to 5 for Almost certain.
Impact runs from 1 for Negligible to 5 for Severe.
The first pasted column fills Likelihood.
The second pasted column fills Impact.
The five lines align with R-001 through R-005 in the table's current order.
This exercise-specific method creates a consistent comparison across the five fictional risks.

Save Northstar_Retail_GRC_Risk_Register.xlsx by pressing Ctrl+S.
Check that C2:D6 displays the pairs 4 | 4, 3 | 4, 4 | 5, 3 | 5, and 2 | 5 from top to bottom.

That's the first layer of prioritization in place: every risk now has a comparable rating pair.

Did the Values Land in One Cell?

Undo the paste by pressing Ctrl+Z.
Select C2 before copying the block again.
Enter the values manually if your clipboard does not preserve the two columns.

Help me fix the likelihood and impact values in my Excel risk register.

Calculate exposure ratings

An exposure rating combines likelihood with impact. Using the same calculation for every row makes the ranking repeatable.

Select cell E2 in the Exposure Rating column.
Calculate all five exposure ratings by copying this formula into E2:

=C2*D2

What Does This Formula Do?

The formula multiplies the likelihood in C2 by the impact in D2.
Excel recognizes Exposure Rating as a calculated table column.
The table copies the formula down through all five risk rows.

Save Northstar_Retail_GRC_Risk_Register.xlsx by pressing Ctrl+S.
Check the five values in E2:E6 from top to bottom.

You should see 16, 12, 20, 15, and 10.

The calculated column is working: one formula now keeps all five exposure ratings consistent.

Only See One Exposure Rating?

Confirm that you entered the formula in E2 inside the Excel table.
Check that the formula begins with an equals sign.
Re-enter =C2*D2 in E2 if the calculated column did not fill.

Help me troubleshoot why my Excel calculated table column did not fill down.

Make priorities visible

Data bars turn each exposure value into a visual signal. Longer bars point to higher values.

Select cells E2:E6.
Select the Home tab.
Select Conditional Formatting in the Styles group.
Select Data Bars.
Choose a data-bar style.

That visual cue is working: higher exposure values now carry longer bars.

Do Not See Five Data Bars?

Confirm that only E2:E6 is selected.
Check that all five cells contain numeric exposure values.
Apply Data Bars again after correcting the selection.

Help me troubleshoot missing data bars in my Excel Exposure Rating column.

Before you sort, form a quick prediction about which Risk ID will move to the top.

Select any cell in the Exposure Rating column.
Select the Data tab.
Select Sort Largest to Smallest in the Sort & Filter group.

What Should You See?

Each row below lists Likelihood, Impact, then Exposure Rating.

The R-003 row is first with 4 | 5 | 20. Its exposure bar is the longest.
The R-001 row follows with 4 | 4 | 16.
The R-004 row follows with 3 | 5 | 15.
The R-002 row follows with 3 | 4 | 12.
The R-005 row is last with 2 | 5 | 10. Its exposure bar is the shortest.

Does the Sort Order Look Wrong?

Re-enter any text-formatted exposure value as a number.
Repeat Sort Largest to Smallest after correcting the values.

Help me correct an unexpected numeric sort order in my Excel risk register.

Save the sorted workbook by pressing Ctrl+S.

Your register now turns five concerns into a clear priority order. Next, you will turn that priority order into an owned action plan with framework traceability.

Map Risks to NIST CSF 2.0

Your sorted cybersecurity risk register in Microsoft Excel now shows which risks demand attention first. Northstar Retail can see urgency through the exposure scores.

A score alone cannot show the framework outcome or accountable owner. This step adds the desired state plus a concrete response so each priority can become a business action.

In this step, get ready to:

Document a Current Profile plus a Target Profile for each risk.
Assign a risk response plus a risk owner to every row.
Build an action plan with a target timeframe for each risk.

Document current and target profiles

The NIST Cybersecurity Framework version 2.0 provides high-level cybersecurity outcomes that organizations can use to describe their priorities. Each selected outcome gives a risk a traceable security result.

How do profiles create action?

A Current Profile describes the outcome Northstar Retail achieves today. A Target Profile describes the desired outcome.

Comparing those states reveals a gap. The action plan closes that gap through assigned work.

Enter ID.RA-01 in the NIST CSF Outcome cell for R-003.
Enter PR.AT-01 in the NIST CSF Outcome cell for R-001.
Enter PR.DS-11 in the NIST CSF Outcome cell for R-004.
Enter PR.AA-05 in the NIST CSF Outcome cell for R-002.
Enter RS.MA-01 in the NIST CSF Outcome cell for R-005.

You should now see one verified framework outcome identifier beside every risk.

Enter Vulnerability reviews are ad hoc; findings are not recorded. in the Current Profile cell for R-003.
Enter Staff receive informal reminders only. in the Current Profile cell for R-001.
Enter Nightly backups exist; restore testing is undocumented. in the Current Profile cell for R-004.
Enter Access is removed through manual offboarding requests; no periodic review exists. in the Current Profile cell for R-002.
Enter Staff escalate incidents informally; third-party coordination is undefined. in the Current Profile cell for R-005.

Each Current Profile now captures the safeguard gap visible in that risk row.

Enter Vulnerabilities in assets are identified, validated, and recorded in the Target Profile cell for R-003.
Enter Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind in the Target Profile cell for R-001.
Enter Backups of data are created, protected, maintained, and tested in the Target Profile cell for R-004.
Enter Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties in the Target Profile cell for R-002.
Enter The incident response plan is executed in coordination with relevant third parties once an incident is declared in the Target Profile cell for R-005.

You have connected all five risks to a current state plus a framework-aligned target outcome.

Assign responses and owners

A risk response records the chosen treatment for a negative risk. Mitigate means Northstar Retail plans to reduce the risk through safeguards.

A risk owner is the fictional role accountable for moving that treatment forward. Ownership turns each framework gap into assigned work.

Enter Mitigate in the Risk Response cell for R-003.
Enter Mitigate in the Risk Response cell for R-001.
Enter Mitigate in the Risk Response cell for R-004.
Enter Mitigate in the Risk Response cell for R-002.
Enter Mitigate in the Risk Response cell for R-005.

Every row should now show the same selected response in the Risk Response column.

Enter IT Manager in the Risk Owner cell for R-003.
Enter Human Resources Manager in the Risk Owner cell for R-001.
Enter Operations Manager in the Risk Owner cell for R-004.
Enter IT Manager in the Risk Owner cell for R-002.
Enter Operations Director in the Risk Owner cell for R-005.

Each risk now has an accountable role beside its selected response.

Build the action plan

The action plan describes the work that moves a risk toward its Target Profile. The target timeframe gives that work a decision-ready deadline.

Enter Start a biweekly vulnerability review and record validated findings. in the Action Plan cell for R-003.
Enter Deliver quarterly awareness training and run a phishing-reporting exercise. in the Action Plan cell for R-001.
Enter Perform a restore test, record the result, and protect one backup from routine access. in the Action Plan cell for R-004.
Enter Approve an access policy and perform a documented access review. in the Action Plan cell for R-002.
Enter Document incident roles and contacts, then run a tabletop exercise with the hosting and payment providers. in the Action Plan cell for R-005.

The Action Plan column should now contain one specific safeguard improvement for every risk.

Enter 14 days in the Target Timeframe cell for R-003.
Enter 30 days in the Target Timeframe cell for R-001.
Enter 30 days in the Target Timeframe cell for R-004.
Enter 30 days in the Target Timeframe cell for R-002.
Enter 45 days in the Target Timeframe cell for R-005.

Every planned safeguard now has a timeframe that leaders can review.

Save Northstar_Retail_GRC_Risk_Register.xlsx by pressing Ctrl+S.

Every risk now has a complete governance path from current state to action.

✔️ Awesome, I've got everything!

Your five risks now have framework mappings plus accountable remediation details. The exposure sort remains unchanged.

ⓧ I'd like to double check the full register

The completed rows should match this reference in descending Exposure Rating order.

R-003. Risk Description: Attackers may exploit unrecorded storefront vulnerabilities because vulnerability reviews are ad hoc. Likelihood: 4. Impact: 5. Exposure Rating: 20. Current Safeguard: Hosting provider patches its platform, but application findings are not recorded. Risk Response: Mitigate. Risk Owner: IT Manager. NIST CSF Outcome: ID.RA-01. Current Profile: Vulnerability reviews are ad hoc; findings are not recorded. Target Profile: Vulnerabilities in assets are identified, validated, and recorded. Action Plan: Start a biweekly vulnerability review and record validated findings. Target Timeframe: 14 days.
R-001. Risk Description: Staff may submit credentials after a phishing message because awareness training is informal. Likelihood: 4. Impact: 4. Exposure Rating: 16. Current Safeguard: Spam filtering and occasional email reminders. Risk Response: Mitigate. Risk Owner: Human Resources Manager. NIST CSF Outcome: PR.AT-01. Current Profile: Staff receive informal reminders only. Target Profile: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind. Action Plan: Deliver quarterly awareness training and run a phishing-reporting exercise. Target Timeframe: 30 days.
R-004. Risk Description: Ransomware may cause a prolonged outage because backups are not restore-tested. Likelihood: 3. Impact: 5. Exposure Rating: 15. Current Safeguard: Nightly backups with no documented restore test. Risk Response: Mitigate. Risk Owner: Operations Manager. NIST CSF Outcome: PR.DS-11. Current Profile: Nightly backups exist; restore testing is undocumented. Target Profile: Backups of data are created, protected, maintained, and tested. Action Plan: Perform a restore test, record the result, and protect one backup from routine access. Target Timeframe: 30 days.
R-002. Risk Description: Former employee accounts may retain access because offboarding reviews are manual. Likelihood: 3. Impact: 4. Exposure Rating: 12. Current Safeguard: Manual manager offboarding request. Risk Response: Mitigate. Risk Owner: IT Manager. NIST CSF Outcome: PR.AA-05. Current Profile: Access is removed through manual offboarding requests; no periodic review exists. Target Profile: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties. Action Plan: Approve an access policy and perform a documented access review. Target Timeframe: 30 days.
R-005. Risk Description: Incident impact may grow because response roles with hosting and payment providers are not coordinated. Likelihood: 2. Impact: 5. Exposure Rating: 10. Current Safeguard: Staff call the IT manager informally. Risk Response: Mitigate. Risk Owner: Operations Director. NIST CSF Outcome: RS.MA-01. Current Profile: Staff escalate incidents informally; third-party coordination is undefined. Target Profile: The incident response plan is executed in coordination with relevant third parties once an incident is declared. Action Plan: Document incident roles and contacts, then run a tabletop exercise with the hosting and payment providers. Target Timeframe: 45 days.

Before you filter the register, which framework mapping do you expect to see on the highest-exposure row?

Select the filter button in the Risk ID header.
Use the menu checkboxes to leave only R-003 selected.
Apply the filter.

You should see R-003 as the only visible risk. Its NIST CSF Outcome cell shows ID.RA-01.

Its Risk Response cell shows Mitigate. Its Risk Owner cell shows IT Manager.

Its Target Timeframe cell shows 14 days. The current state plus the target outcome are also populated.

That is the governance link complete: the highest exposure now leads to an owned action.

Does the R-003 row look different?

Leave only R-003 selected in the Risk ID filter.
Confirm you entered each governance value by Risk ID after the earlier sort.

Ask for help with the values you see: Help me check why my filtered R-003 row does not match the expected NIST mapping and ownership details.

Your register now explains what matters plus who acts on it. Next, you will turn the three highest exposures into a leadership summary.

Build the Executive Risk Summary

Your cybersecurity risk register now ranks five risks by exposure. Each risk also has an owner plus a framework-aligned action.

A complete register gives analysts detailed evidence. Leaders need a short view that turns the highest exposures into clear decisions.

In this step, get ready to:

Lay out the executive summary block.
Present the three highest-exposure risks.
Add the leadership decision request.

Create the summary block

The summary needs a clear title plus four columns that answer the questions a leader asks first. Those columns show the order of attention, the risk, its exposure, plus the recommended action.

Scroll horizontally in the open workbook until columns R through U are visible.
Enter Executive Risk Summary in cell R1.
Select cell R3.
Fill cells R3:U3 by pasting this tab-separated header row:

Priority	Risk	Exposure	Recommended Action

What Does This Header Row Do?

The tab separators place one label in each cell from R3 through U3. The resulting columns connect each priority to a specific leadership action.

Save the workbook by pressing Ctrl+S.
Review cells R1 plus R3:U3.

You'll see the summary title above four separate headers. That first frame is in place, so the detailed register now has a leadership-facing destination.

Did the Headers Land in One Cell?

Clear the pasted text from cell R3.
Select cell R3.
Copy the tab-separated header line again.
Paste the copied line into the selected cell.

Help me fix a header row that pasted into one Excel cell.

Present the top three risks

The register is already sorted from the highest exposure to the lowest. The summary carries its first three risks forward in the same order.

Select cell R4.
Fill cells R4:U6 by pasting these three tab-separated rows:

1	R-003: Unrecorded storefront vulnerabilities	20	Begin the biweekly vulnerability review within 14 days.
2	R-001: Informal phishing awareness	16	Deliver training and test the reporting process within 30 days.
3	R-004: Backups are not restore-tested	15	Complete and document a restore test within 30 days.

How Does This Create a Priority View?

The three rows preserve the descending exposure order from the register. Each recommended action condenses its risk plan into one time-bound instruction.

A leader can now see where action starts without reading all five register rows. The highest exposure receives priority 1.

Save the workbook by pressing Ctrl+S.
Review cells R4:U6.

You'll see exposures 20, 16, plus 15 in descending order. The summary now gives leaders a clear order for all three actions.

Do the Risk Rows Look Misaligned?

Clear cells R4:U6 if a previous paste left partial data.
Select cell R4.
Copy the complete three-row block again.
Paste the copied block into the selected cell.

Help me align the executive summary rows in Excel.

Add the leadership decision

A ranked list identifies where attention belongs. A decision request tells leaders exactly what they need to approve.

Enter Decision Needed in cell R8.
Enter Approve owners and target timeframes for the three highest-exposure actions. in cell S8.

You'll see a direct approval request beneath the ranked risks. The summary now connects analysis to a leadership decision.

Save Northstar_Retail_GRC_Risk_Register.xlsx by pressing Ctrl+S.

Before you review the finished summary, which risk do you expect a leader to see first?

Scroll to cells R1:U8.

You'll see R-003 as priority 1 with exposure 20. Its recommended action tells leaders to begin the biweekly vulnerability review within 14 days without inspecting the full register.

Does Priority 1 Look Wrong?

Confirm cell S4 contains R-003: Unrecorded storefront vulnerabilities.
Confirm cell T4 contains the number 20.
Compare cells R4:U6 with the summary reference below.

Help me correct an executive summary whose first priority is not R-003.

✔️ Awesome, I've got everything!

Your summary identifies the three highest-exposure risks. Double check that the workbook is saved before moving on.

ⓧ I'd like to double check the full summary

Compare cells R1:U8 against this complete reference:

Executive Risk Summary

Priority	Risk	Exposure	Recommended Action
1	R-003: Unrecorded storefront vulnerabilities	20	Begin the biweekly vulnerability review within 14 days.
2	R-001: Informal phishing awareness	16	Deliver training and test the reporting process within 30 days.
3	R-004: Backups are not restore-tested	15	Complete and document a restore test within 30 days.

Decision Needed	Approve owners and target timeframes for the three highest-exposure actions.

How to Read This Reference

Each line represents one worksheet row. Tabs separate values across columns R through U.

The blank lines represent rows 2 plus 7. Those rows preserve the spacing around the summary content.

Strong finish. Your workbook now turns detailed risk analysis into a leadership decision.

Secret mission

Estimate Residual Risk

Your register shows Northstar Retail's current exposure. This challenge adds a residual-risk view that estimates what remains after each planned safeguard. You will compare the two ratings so leaders can see the expected reduction.

Clean Up Your Resources

Your project is stored in one local Microsoft Excel workbook, so there are no ongoing cloud costs. Decide whether to keep the workbook available, pause by closing Excel, or delete the file entirely.

Resources you used:

The local Northstar_Retail_GRC_Risk_Register.xlsx workbook.

Keep everything running

No action needed. Choose this if you want to keep reviewing or updating your completed risk register.

Leave Northstar_Retail_GRC_Risk_Register.xlsx in its saved local folder.
Press Ctrl+S in Excel after any future edits.

Pause - I'll come back to this later

Close Excel to free up memory. Your saved risk register remains available on your Windows device.

Press Ctrl+S in the Excel window from earlier.
Close Excel.
Use your Windows file browser to return to the local folder where you saved Northstar_Retail_GRC_Risk_Register.xlsx when you are ready to continue.
Double-click Northstar_Retail_GRC_Risk_Register.xlsx to resume your work.

Delete - I don't want to use this again

Remove the local workbook if you no longer need the risk register. This deletes the project artifact from its saved folder.

Close Excel so Windows can remove the workbook.
Use your Windows file browser to return to the local folder where you saved the workbook.
Select Northstar_Retail_GRC_Risk_Register.xlsx.
Delete the selected workbook.
Confirm that Northstar_Retail_GRC_Risk_Register.xlsx no longer appears in the saved folder.

Nice Work!

You turned Northstar Retail's scattered security concerns into a decision-ready workbook in Microsoft Excel. The finished cybersecurity risk register gives leaders a clear view of current exposure alongside planned residual exposure.

Here's what you learned:

Built a five-item risk register for Northstar Retail with visible current safeguards.
Created a repeatable exposure score from likelihood and impact. Data bars plus descending sort make the highest priorities visible.
Mapped each risk to NIST CSF 2.0. The executive summary turns the top three exposures into owned actions with target timeframes.
Completed the optional Secret Mission by estimating residual exposure after planned safeguards. The comparison shows R-003 falling from 20 to 8 alongside lower residual ratings for every risk.

Ready to quiz yourself?