Cybersecurity Risk Assessment

Build a portfolio-ready risk register and heat map for a healthcare startup.

Introduction

30 Second Summary

Every company that stores sensitive data faces cybersecurity threats. Someone has to find those threats, measure how dangerous they are, and tell leadership what to do about them.

In this project, you will role-play as a GRC Analyst hired by a fictional healthcare startup called MedVault. You will conduct a structured risk assessment and produce three portfolio-ready artifacts: a risk register, a heat map, and an executive summary.

What You'll Build

You will produce a complete cybersecurity risk assessment package aligned with the NIST Cybersecurity Framework 2.0, using Google Sheets and Google Docs.

By the end of this project, you'll have:

A risk register spreadsheet with 12 identified cybersecurity risks scored using a 5x5 matrix, each with a treatment decision and justification.
A color-coded risk heat map that communicates MedVault's risk posture at a glance.
A one-page executive risk summary written for a non-technical CEO, translating technical risks into business language.
Secret Mission: Map your top risks to specific NIST CSF 2.0 categories and recommend controls for each.

Are there any prerequisites?

You need a Google account (free to create) to use Google Sheets and Google Docs. No prior cybersecurity or GRC experience is required.

You will also reference the NIST CSF 2.0 PDF, which is freely available from nist.gov. The project walks you through everything step by step.

Set Up Your Workspace and Understand the Scenario

Before you can assess risks, you need a clear workspace and a solid understanding of the organization you are protecting. Every real-world risk assessment starts the same way: learn the business context first, then set up your documentation tools.

In this step, you will create the two documents that form your assessment deliverables, read the scenario brief for your fictional client (MedVault), and orient yourself in the NIST Cybersecurity Framework 2.0 that guides the entire assessment.

In this step, get ready to:

Create your risk register spreadsheet and executive summary document.
Read the MedVault scenario brief.
Review the six NIST CSF 2.0 Functions that organize cybersecurity outcomes.

Create your project documents

You need two documents for this assessment: a Google Sheets spreadsheet for your risk register and a Google Docs document for your executive summary.

Open your browser and navigate to sheets.google.com.
Sign in with your Google account if prompted.
Click the Blank spreadsheet option (the large + icon) to create a new spreadsheet.
Click the title at the top left (it says "Untitled spreadsheet" by default) and rename it to MedVault Risk Register.
Press Enter to confirm the name.

Your spreadsheet is ready. Now create the executive summary document.

Open a new browser tab and navigate to docs.google.com.
Click the Blank document option (the large + icon) to create a new document.
Click the title at the top left (it says "Untitled document" by default) and rename it to MedVault Executive Risk Summary.
Press Enter to confirm the name.

Why Google Sheets and Google Docs?

Many GRC analysts at startups and mid-size companies use spreadsheets for risk registers in practice. Enterprise tools like Vanta or ServiceNow GRC cost thousands per year, but the analytical thinking is identical regardless of the tool.

Google Sheets and Docs are free, shareable, and produce the same portfolio artifact a hiring manager wants to see.

Not seeing the Blank spreadsheet option?

Make sure you are signed into your Google account. If you see a sign-in page, enter your Google email and password first. After signing in, the blank template appears at the top of the home screen.

Having trouble with your Google account?

Read the MedVault scenario brief

Every risk assessment begins with understanding the organization. Here is the scenario you will work from throughout this project.

Who is MedVault?

MedVault is a fictional 50-person cloud-based healthcare startup. They store Protected Health Information (PHI) in AWS, have a remote workforce, use a SaaS Electronic Health Records (EHR) platform, and process insurance claims.

MedVault is subject to HIPAA regulations. Their current security posture is immature: no dedicated security team, no formal policies, no MFA on all systems, and they recently experienced a phishing attempt.

Read through the MedVault scenario above carefully.
Note the key details: 50 employees, cloud-hosted PHI, remote workforce, SaaS dependencies, HIPAA obligations, and an immature security posture.

Why does the scenario matter for risk scoring?

When you score risks later, you will use these scenario details to justify your likelihood and impact ratings. A company with no MFA and no security team has a much higher likelihood of credential theft than one with mature controls in place.

Review the NIST CSF 2.0 Functions

The NIST Cybersecurity Framework 2.0 organizes cybersecurity outcomes into six high-level Functions. You will use these to categorize each risk in your register.

Open a new browser tab and navigate to the NIST CSF 2.0 PDF: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf.
Skim through the document to find the six Functions listed in Section 2 (the CSF Core).
You do not need to memorize anything. Just confirm you can see the six Functions and understand that they are used to organize cybersecurity outcomes.

What are the six NIST CSF 2.0 Functions?

The six Functions are the top-level categories for organizing cybersecurity activities:

Govern (GV) establishes the organization's cybersecurity risk management strategy and expectations.
Identify (ID) helps you understand the organization's assets, risks, and environment.
Protect (PR) covers safeguards to manage cybersecurity risks (access control, training, data security).
Detect (DE) focuses on finding and analyzing possible cybersecurity attacks and compromises.
Respond (RS) covers actions taken once a cybersecurity incident is detected.
Recover (RC) addresses restoring operations after an incident.

You will assign one of these Functions to each risk in your register. This maps your findings to an industry-standard framework, which is exactly what employers expect to see.

Keep the PDF open

Leave the NIST CSF 2.0 PDF open in its own browser tab. You will reference it when assigning Functions to your risks in Step 3, and again if you tackle the Secret Mission.

Your workspace is set up and you have a solid understanding of both the client scenario and the framework guiding your assessment. Next, you will build the structure of your risk register with proper column headers and scoring criteria.

Build Your Risk Register Structure

Your workspace is ready and you have a clear picture of MedVault's situation. Now it's time to build the structure that will hold your risk analysis.

A risk register is the core artifact of any risk assessment. It's a structured table where you document each risk, score it, and record your treatment decision.

In this step, get ready to:

Create column headers that define your register's structure.
Build scoring reference tables for likelihood and impact.
Add a formula that automatically calculates risk scores.

Create your column headers

Every risk register needs consistent columns so that each risk is documented the same way. Your headers define what information you capture for every risk you identify.

Switch back to your "MedVault Risk Register" spreadsheet in Google Sheets.
Click on cell A1.
Type the following headers across Row 1, one per cell from A1 to K1:

A1: Risk ID
B1: Risk Description
C1: Threat Source
D1: Affected Asset
E1: NIST CSF Function
F1: Likelihood (1-5)
G1: Impact (1-5)
H1: Risk Score
I1: Risk Level
J1: Risk Treatment
K1: Treatment Justification

What do these columns mean?

Risk ID gives each risk a unique label (like RISK-001) so you can reference it elsewhere. Threat Source identifies who or what causes the risk. Affected Asset names what could be harmed.

Likelihood and Impact are your numerical scores (1-5). Risk Score multiplies them together. Risk Treatment is your decision about what to do, and Treatment Justification explains why.

Select all of Row 1 by clicking the row number 1 on the left side.
Click the Bold button (or press Ctrl+B) to make your headers stand out.

Build your scoring reference tables

Scoring criteria ensure consistency. Without defined scales, a "4" could mean different things to different people. Your reference tables lock in exactly what each number means.

Click on cell A20 to move below your register area.
Type LIKELIHOOD SCALE in cell A20 and bold it.
Enter the following scale in cells A21 through A25, one per row:

A21: 1 = Rare (less than 5% chance per year)
A22: 2 = Unlikely (5-20%)
A23: 3 = Possible (20-50%)
A24: 4 = Likely (50-80%)
A25: 5 = Almost Certain (greater than 80%)

Skip a row and type IMPACT SCALE in cell A27. Bold it.
Enter the following scale in cells A28 through A32:

A28: 1 = Negligible (minimal disruption)
A29: 2 = Minor (some disruption, no data loss)
A30: 3 = Moderate (significant disruption or small data exposure)
A31: 4 = Major (large data breach, regulatory fines)
A32: 5 = Catastrophic (business-ending event, massive HIPAA violation)

Skip another row and type RISK LEVEL THRESHOLDS in cell A34. Bold it.
Enter the following thresholds in cells A35 through A38:

A35: 1-5 = Low (green)
A36: 6-10 = Medium (yellow)
A37: 11-15 = High (orange)
A38: 16-25 = Critical (red)

Why a 5x5 matrix?

The 5x5 risk matrix is a semi-quantitative approach recognized by NIST SP 800-30. It uses numbered scales to produce a risk score, but the numbers represent defined categories rather than precise measurements.

This is the most common method in entry-level GRC roles because it balances analytical rigor with practical simplicity. More advanced methods like FAIR use fully quantitative analysis with dollar values.

Add the Risk Score formula

Instead of calculating each risk score manually, you can use a formula that multiplies Likelihood by Impact automatically. This ensures accuracy across all 12 risks.

Click on cell H2 (the first empty cell under your Risk Score header).
Type the following formula and press Enter:

=F2*G2

What does this formula do?

This formula multiplies the Likelihood value in column F by the Impact value in column G. The result is your Risk Score, which ranges from 1 (lowest risk) to 25 (highest risk).

The cell will show 0 or appear empty right now because you haven't entered any risk data yet. Once you populate rows with scores in the next step, the formula calculates automatically.

Verify the formula is in place by clicking on cell H2 and checking that the formula bar at the top shows =F2*G2.

You'll copy this formula later

In the next step, after entering all 12 risks, you will select cell H2 and drag the fill handle down to H13 to apply the formula to every row. For now, having it in H2 is enough.

Formula showing an error?

Make sure you typed the formula starting with the equals sign. Without it, Google Sheets treats the entry as plain text instead of a calculation.

Check that you are in cell H2, not a different cell. The formula references F2 and G2 specifically.

Help me fix my Risk Score formula in Google Sheets.

Your register now has all 11 column headers, your scoring criteria locked in below, and an automated formula ready to calculate risk scores.

Your register structure is locked in. Next up, you'll fill it with 12 real cybersecurity risks and score each one using the scales you just built.

Identify and Score 12 Risks

Your risk register has a solid structure with headers, scoring criteria, and a formula ready to go. Now it is time to fill it with actual risks.

In this step, you will think like a GRC Analyst and identify 12 cybersecurity threats facing MedVault. You will score each risk using your likelihood and impact scales, then decide how the company should respond to each one.

In this step, get ready to:

Identify 12 cybersecurity risks relevant to MedVault's healthcare environment.
Score each risk for likelihood and impact using your reference tables.
Assign a risk treatment decision with a written justification for each risk.

Identify 12 cybersecurity risks for MedVault

Risk identification is the foundation of any assessment. You need to think through what could go wrong for a 50-person healthcare startup that stores PHI in the cloud, has a remote workforce, and has no dedicated security team.

Switch back to your MedVault Risk Register spreadsheet in Google Sheets.
Starting in Row 2, enter each of the 12 risks below into their own row.
For each risk, fill in columns A through E: Risk ID, Risk Description, Threat Source, Affected Asset, and NIST CSF Function.

Here are the 12 risks to enter, along with their details:

RISK-001 : Phishing attacks on employees. Threat Source: External attacker. Affected Asset: Employee credentials. NIST CSF Function: Protect (PR).
RISK-002 : Ransomware encrypting patient data. Threat Source: External attacker (criminal). Affected Asset: Patient database/PHI. NIST CSF Function: Protect (PR).
RISK-003 : Misconfigured AWS S3 buckets exposing PHI. Threat Source: Internal misconfiguration. Affected Asset: Cloud storage (S3). NIST CSF Function: Protect (PR).
RISK-004 : Insider threat from disgruntled employee. Threat Source: Internal (employee). Affected Asset: PHI and internal systems. NIST CSF Function: Protect (PR).
RISK-005 : Third-party vendor breach (EHR platform). Threat Source: External vendor. Affected Asset: EHR system and patient data. NIST CSF Function: Govern (GV).
RISK-006 : Lack of MFA leading to credential theft. Threat Source: External attacker. Affected Asset: User accounts and systems. NIST CSF Function: Protect (PR).
RISK-007 : Unpatched software vulnerabilities. Threat Source: External attacker exploiting known CVEs. Affected Asset: Servers and applications. NIST CSF Function: Protect (PR).
RISK-008 : Lost or stolen employee laptops with local data. Threat Source: Physical theft or loss. Affected Asset: Endpoint devices. NIST CSF Function: Protect (PR).
RISK-009 : DDoS attack on patient portal. Threat Source: External attacker. Affected Asset: Patient portal (web application). NIST CSF Function: Protect (PR).
RISK-010 : Lack of incident response plan. Threat Source: Organizational gap. Affected Asset: All systems (response capability). NIST CSF Function: Respond (RS).
RISK-011 : Non-compliance with HIPAA audit requirements. Threat Source: Regulatory body. Affected Asset: Organization (compliance posture). NIST CSF Function: Govern (GV).
RISK-012 : Shadow IT (unauthorized SaaS tools). Threat Source: Internal (employees). Affected Asset: Corporate data and network. NIST CSF Function: Identify (ID).

How did we pick the NIST CSF Function for each risk?

Each risk maps to the NIST CSF 2.0 Function that best addresses the outcome needed. For example, phishing relates to Protect (PR) because the outcome is about safeguarding people and assets.

Third-party vendor risk maps to Govern (GV) because supply chain risk management falls under organizational governance. Shadow IT maps to Identify (ID) because you cannot protect what you do not know exists.

Use the scenario to guide your thinking

Review the MedVault scenario details from Step 1 as you fill in each row. The fact that MedVault has no MFA, no formal policies, and recently experienced a phishing attempt directly informs how you describe and contextualize each risk.

Score each risk for likelihood and impact

Now that your 12 risks are entered, you need to assign a Likelihood score (1-5) and Impact score (1-5) to each one. Your scoring criteria reference tables (starting at row 20) are your guide here.

For each risk in rows 2 through 13, enter a Likelihood score in column F based on how probable the threat is given MedVault's current security posture.
Enter an Impact score in column G based on the potential damage if the threat materializes.
After entering both scores, verify that column H (Risk Score) automatically calculates by checking that the formula =F2*G2 is producing a result in cell H2.
Copy the formula in H2 down through cell H13 so all 12 rows calculate automatically.

How should I think about scoring?

Use the MedVault scenario to justify every score. A company with no security awareness training makes phishing "Almost Certain" (5). A company storing PHI means a successful phishing attack has "Major" impact (4) because it could lead to credential theft and data exposure.

An insider threat at a 50-person startup with presumably strong team bonds might be "Unlikely" (2), but the impact could still be "Major" (4) because one person could access sensitive patient records.

Here is a recommended scoring guide for each risk based on MedVault's scenario:

RISK-001 (Phishing): Likelihood 5, Impact 4, Score 20, Critical.
RISK-002 (Ransomware): Likelihood 4, Impact 5, Score 20, Critical.
RISK-003 (S3 Misconfiguration): Likelihood 4, Impact 5, Score 20, Critical.
RISK-004 (Insider Threat): Likelihood 2, Impact 4, Score 8, Medium.
RISK-005 (Vendor Breach): Likelihood 3, Impact 4, Score 12, High.
RISK-006 (No MFA): Likelihood 5, Impact 4, Score 20, Critical.
RISK-007 (Unpatched Software): Likelihood 4, Impact 3, Score 12, High.
RISK-008 (Lost Laptops): Likelihood 3, Impact 3, Score 9, Medium.
RISK-009 (DDoS): Likelihood 3, Impact 3, Score 9, Medium.
RISK-010 (No IR Plan): Likelihood 5, Impact 4, Score 20, Critical.
RISK-011 (HIPAA Non-compliance): Likelihood 4, Impact 5, Score 20, Critical.
RISK-012 (Shadow IT): Likelihood 4, Impact 2, Score 8, Medium.

In column I (Risk Level), enter the corresponding level for each risk based on the score thresholds in your reference table: 1-5 = Low, 6-10 = Medium, 11-15 = High, 16-25 = Critical.

Why does the scoring matter so much?

The Risk Score (Likelihood x Impact) is how organizations prioritize where to spend limited security budget. A Critical risk with a score of 20+ demands immediate attention, while a Medium risk with a score of 8 might be acceptable for now.

This is the core analytical skill that GRC hiring managers evaluate. They want to see that you can justify why a particular risk is scored high or low based on real organizational context.

Assign risk treatment decisions with justifications

Every identified risk needs a treatment decision. There are four standard options: Accept, Mitigate, Transfer, or Avoid.

For each risk, enter one of these four treatment decisions in column J (Risk Treatment):
Accept means the risk is low enough to tolerate without additional action.
Mitigate means you will implement controls to reduce the likelihood or impact.
Transfer means you shift the risk to a third party (like cyber insurance).
Avoid means you eliminate the activity that causes the risk entirely.

In column K (Treatment Justification), write a brief explanation for each decision that references a specific control or rationale.

What does a good justification look like?

A strong justification names a specific action and connects it to the risk. For example, for ransomware (RISK-002) you might write: "Mitigate - Implement daily encrypted backups, deploy endpoint detection and response (EDR), and segment the network to contain lateral movement."

For the insider threat (RISK-004) you might write: "Accept - Low likelihood at current company size. Revisit when headcount exceeds 100 or after any HR incident."

Here are recommended treatment decisions for each risk:

RISK-001 (Phishing): Mitigate. Deploy security awareness training, implement email filtering, and conduct quarterly phishing simulations.
RISK-002 (Ransomware): Mitigate. Implement daily backups, endpoint detection, and network segmentation to reduce likelihood and impact.
RISK-003 (S3 Misconfiguration): Mitigate. Enable AWS Config rules for S3 public access, implement automated compliance checks, and restrict bucket policies.
RISK-004 (Insider Threat): Accept. Low likelihood at current company size. Revisit when headcount exceeds 100 or after any HR incident.
RISK-005 (Vendor Breach): Transfer. Require cyber insurance, include breach notification clauses in vendor contracts, and conduct annual vendor security assessments.
RISK-006 (No MFA): Mitigate. Enable MFA on all systems immediately. Prioritize admin accounts, then extend to all employees within 2 weeks.
RISK-007 (Unpatched Software): Mitigate. Establish a 30-day patch cycle for critical vulnerabilities and 90-day cycle for non-critical updates.
RISK-008 (Lost Laptops): Mitigate. Enable full-disk encryption, deploy remote wipe capability, and enforce device registration.
RISK-009 (DDoS): Mitigate. Implement a CDN with DDoS protection and configure rate limiting on the patient portal.
RISK-010 (No IR Plan): Mitigate. Develop and document an incident response plan, assign roles, and conduct tabletop exercises quarterly.
RISK-011 (HIPAA Non-compliance): Mitigate. Conduct a HIPAA gap analysis, assign a compliance officer, and implement required administrative and technical safeguards.
RISK-012 (Shadow IT): Mitigate. Deploy a cloud access security broker (CASB), create an approved software list, and educate employees on the policy.

Why do most risks get "Mitigate" as treatment?

In practice, most cybersecurity risks are mitigated rather than accepted, transferred, or avoided. This is because organizations cannot eliminate the activities that cause risk (Avoid is rarely practical), and many risks are too severe to simply accept.

Transfer (insurance) is typically reserved for financial impact, not as a primary treatment. A real-world risk register usually shows 70-80% Mitigate decisions, which is what hiring managers expect to see.

✔️ Awesome, I've got everything!

Great. Double check that you have 12 rows filled (rows 2 through 13) and that every cell from column A through K has data in it.

ⓧ I'd like to double check the full register

Here is a summary of what your completed risk register should look like across all 12 rows. Every row should have: Risk ID, Risk Description, Threat Source, Affected Asset, NIST CSF Function, Likelihood, Impact, Risk Score (formula), Risk Level, Risk Treatment, and Treatment Justification.

Row 2: RISK-001, Phishing attacks on employees, External attacker, Employee credentials, Protect (PR), 5, 4, =F2*G2 (20), Critical, Mitigate, Deploy security awareness training and email filtering.
Row 3: RISK-002, Ransomware encrypting patient data, External attacker (criminal), Patient database/PHI, Protect (PR), 4, 5, =F3*G3 (20), Critical, Mitigate, Implement daily backups, EDR, and network segmentation.
Row 4: RISK-003, Misconfigured AWS S3 buckets exposing PHI, Internal misconfiguration, Cloud storage (S3), Protect (PR), 4, 5, =F4*G4 (20), Critical, Mitigate, Enable AWS Config rules and restrict bucket policies.
Row 5: RISK-004, Insider threat from disgruntled employee, Internal (employee), PHI and internal systems, Protect (PR), 2, 4, =F5*G5 (8), Medium, Accept, Low likelihood at current size. Revisit at 100+ headcount.
Row 6: RISK-005, Third-party vendor breach (EHR platform), External vendor, EHR system and patient data, Govern (GV), 3, 4, =F6*G6 (12), High, Transfer, Require cyber insurance and vendor security assessments.
Row 7: RISK-006, Lack of MFA leading to credential theft, External attacker, User accounts and systems, Protect (PR), 5, 4, =F7*G7 (20), Critical, Mitigate, Enable MFA on all systems within 2 weeks.
Row 8: RISK-007, Unpatched software vulnerabilities, External attacker exploiting known CVEs, Servers and applications, Protect (PR), 4, 3, =F8*G8 (12), High, Mitigate, Establish 30-day critical patch cycle.
Row 9: RISK-008, Lost or stolen employee laptops, Physical theft or loss, Endpoint devices, Protect (PR), 3, 3, =F9*G9 (9), Medium, Mitigate, Enable full-disk encryption and remote wipe.
Row 10: RISK-009, DDoS attack on patient portal, External attacker, Patient portal (web application), Protect (PR), 3, 3, =F10*G10 (9), Medium, Mitigate, Implement CDN with DDoS protection.
Row 11: RISK-010, Lack of incident response plan, Organizational gap, All systems (response capability), Respond (RS), 5, 4, =F11*G11 (20), Critical, Mitigate, Develop IR plan and conduct quarterly tabletop exercises.
Row 12: RISK-011, Non-compliance with HIPAA audit requirements, Regulatory body, Organization (compliance posture), Govern (GV), 4, 5, =F12*G12 (20), Critical, Mitigate, Conduct HIPAA gap analysis and assign compliance officer.
Row 13: RISK-012, Shadow IT (unauthorized SaaS tools), Internal (employees), Corporate data and network, Identify (ID), 4, 2, =F13*G13 (8), Medium, Mitigate, Deploy CASB and create approved software list.

Your scoring reference tables should remain unchanged in rows 20 and below.

Risk Score column showing 0 or blank?

Make sure you copied the formula from H2 down through H13. Select cell H2, copy it, then select cells H3 through H13 and paste.

If the formula shows 0, check that your Likelihood and Impact columns (F and G) have numeric values, not text. Delete the cell content and re-type just the number.

Help me figure out why my Risk Score formula is not calculating correctly.

Your risk register now has 12 fully scored risks with treatment decisions. Next up, you will turn this data into a visual risk heat map that communicates MedVault's risk posture at a glance.

Create Your Risk Heat Map

Your risk register now holds 12 scored risks, but a spreadsheet full of numbers does not communicate risk posture effectively to busy executives.

In this step, you will build a risk heat map that translates your likelihood and impact scores into a color-coded 5x5 grid. This visual lets anyone understand where the biggest threats are concentrated in under five seconds.

In this step, get ready to:

Create a 5x5 grid on a new sheet tab with labeled axes.
Color-code cells by risk level and place your Risk IDs.
Add a title and color legend for executive-ready presentation.

Set up the 5x5 heat map grid

A 5x5 risk matrix places Likelihood on one axis and Impact on the other. Each cell represents a unique combination of the two scores, making it easy to see which risks cluster in the danger zone.

In your MedVault Risk Register spreadsheet, click the + icon next to the existing sheet tab at the bottom of the screen to add a new sheet.
Double-click the new tab name and rename it to Heat Map.
In cell A1, type Likelihood \ Impact to label the corner where the two axes meet.
In cells B1 through F1, type the Impact column headers: 1, 2, 3, 4, 5 (left to right, representing lowest to highest impact).
In cells A2 through A6, type the Likelihood row headers: 5, 4, 3, 2, 1 (top to bottom, so the highest likelihood is at the top).

Why is likelihood 5 at the top?

Placing the highest likelihood at the top means the most dangerous risks (high likelihood AND high impact) cluster in the top-right corner. This is the standard convention for risk heat maps because it draws the reader's eye to the danger zone first.

You should now see a grid with 5 columns (Impact 1-5) and 5 rows (Likelihood 5-1), creating 25 empty cells ready for color and content.

Color-code cells and place your Risk IDs

Each cell in the grid corresponds to a risk score (Likelihood x Impact). You will apply fill colors to show risk severity at a glance, then drop your Risk IDs into their matching cells.

Select all cells where Likelihood x Impact equals 1-5 (the Low zone). These are cells like (Likelihood 1, Impact 1) through (Likelihood 1, Impact 5) and (Likelihood 5, Impact 1).
Click the Fill color button (paint bucket icon) in the toolbar and choose a green color for these Low-risk cells.
Select cells where the product equals 6-10 (the Medium zone) and apply a yellow fill color.
Select cells where the product equals 11-15 (the High zone) and apply an orange fill color.
Select cells where the product equals 16-25 (the Critical zone) and apply a red fill color.

Multiply the axes to find each cell's zone

For each cell, multiply its row's Likelihood value by its column's Impact value. For example, the cell at row 3 (Likelihood) and column 4 (Impact) has a score of 12, which falls in the High/orange zone.

Switch back to your first sheet tab (the risk register) and note each risk's Likelihood and Impact scores in the F and G columns.
Return to the Heat Map tab. For each risk, find the cell that matches its Likelihood (row) and Impact (column), then type the Risk ID (e.g. RISK-001) into that cell.
If multiple risks share the same Likelihood and Impact scores, list them in the same cell separated by a comma (e.g. RISK-003, RISK-007).

Your grid should now show all 12 Risk IDs (RISK-001 through RISK-012) distributed across the colored cells based on their individual scores.

Risk IDs not lining up with the right cells?

Remember that row 5 is at the top (row 2 in the sheet), not the bottom. Double-check you are reading the Likelihood value as the row and Impact value as the column.

If a risk appears in a green cell but you expected it in orange, cross-reference the Likelihood and Impact columns on your register tab to confirm you copied the correct scores.

Help me troubleshoot my heat map placement

Add a title and color legend

A heat map without a title or legend forces the reader to guess what the colors mean. Adding these finishing touches makes the artifact self-explanatory and portfolio-ready.

Click on a cell above your grid (such as B1 if you shift your grid down, or use a merged cell range above row 1). Type the title MedVault Cybersecurity Risk Heat Map.
Bold the title by selecting the cell and pressing Ctrl+B. Increase the font size to 14 or 16 so it stands out.
Below or beside your grid, create a simple legend with four entries. In four adjacent cells, type: Low (1-5), Medium (6-10), High (11-15), Critical (16-25).
Apply the matching fill color to each legend cell (green, yellow, orange, red) so readers can decode the grid instantly.

What makes this portfolio-ready?

A hiring manager should be able to look at your heat map for five seconds and understand where the biggest risks are concentrated. If most of your Risk IDs cluster in the orange and red zones, that tells a clear story: MedVault's security posture needs urgent attention.

The title, axis labels, and legend together make the artifact self-contained. Nobody should need to ask you what the colors mean.

Your heat map now gives MedVault's leadership a visual snapshot of their cybersecurity risk landscape. Next up, you will translate these findings into a one-page executive summary that a non-technical CEO can act on in under two minutes.

Write the Executive Risk Summary

Your risk register captures the technical details. Your heat map shows the landscape visually. Now you need to answer the question every executive asks: "So what?"

In this step, you will write a one-page executive risk summary that translates your technical findings into business language. This is the artifact that proves you can communicate risk to leadership, which is the single most valued soft skill in GRC roles.

In this step, get ready to:

Write a structured memo with Purpose, Methodology, and Key Findings sections.
Add prioritized recommendations framed in business terms.
Review and polish the summary for executive-readiness.

Write the Purpose, Methodology, and Key Findings sections

An executive summary is not a technical report. It is a decision-enabling document. Every sentence should help the reader understand the risk and decide what to do about it.

Switch back to your MedVault Executive Risk Summary Google Doc.
At the top, type the heading: Cybersecurity Risk Assessment Summary.
Below it, add the addressee line: To: Sarah Chen, CEO, MedVault Inc..
Add a date line with today's date.
Add a From: line with your name and title (e.g., From: [Your Name], GRC Analyst).

Now add the three opening sections of the memo.

Type the section heading Purpose and write one sentence explaining that this document summarizes a cybersecurity risk assessment conducted for MedVault.
Type the section heading Methodology and write one sentence explaining that you used a qualitative 5x5 risk matrix aligned with NIST SP 800-30 to assess likelihood and impact of identified threats.
Type the section heading Key Findings and write 3-4 bullet points summarizing your most critical risks.

How do I write Key Findings in business language?

Executives care about money, customers, and reputation. Translate each finding from technical language into one of those categories.

Instead of "RISK-002: Ransomware, Likelihood 5, Impact 5", write something like: "Patient data encryption attack is near-certain given current controls. A successful attack could halt operations for 2+ weeks and trigger HIPAA penalties exceeding $1M."

Focus on the 3-4 risks that scored Critical or High on your heat map. Those are what leadership needs to act on.

Use your risk register as a reference

Keep your MedVault Risk Register spreadsheet open in another tab. Pull the risk descriptions and scores directly from it so your summary stays consistent with your analysis.

Add Recommendations and a Risk Acceptance Statement

Findings without recommendations leave executives stuck. This section tells leadership exactly what to do, how long it will take, and how much effort is involved.

Type the section heading Recommendations.
Write your top 3 priority actions as numbered items. For each one, include an estimated timeline and a rough effort level (low, medium, or high).
Frame every recommendation in business terms, not technical terms.

What does a business-framed recommendation look like?

A technical recommendation says: "Implement MFA across all systems." A business-framed recommendation says: "Protect customer accounts and reduce breach likelihood by 80% by enabling multi-factor authentication across all systems (2-week implementation, low cost)."

Notice the structure: business benefit first, then the action, then the effort. This helps executives weigh cost against value immediately.

Below your recommendations, type the section heading Risk Acceptance Statement.
Write one sentence: "The following risks have been accepted with documented justification:" followed by a list of any risks you marked as Accept in your risk register.
For each accepted risk, include the Risk ID and a brief reason why acceptance is appropriate (e.g., the cost of mitigation outweighs the potential impact).

Why include a Risk Acceptance Statement?

Documenting accepted risks protects both you and the organization. It creates a paper trail showing that leadership was informed of the risk and consciously chose to accept it. If that risk materializes later, no one can claim they were never told.

Review your summary for executive-readiness

A busy CEO should be able to read your summary in under 2 minutes and make an informed decision. That means every word needs to earn its place.

Read through your entire document from top to bottom.
Remove any technical jargon that a non-technical CEO would not understand. Replace terms like "S3 bucket misconfiguration" with "cloud storage left publicly accessible."
Confirm your document fits on one page. If it runs longer, cut detail from Key Findings or Recommendations until it fits.
Verify that you use bullet points rather than long paragraphs throughout the document.
Check that every recommendation includes a timeline and effort level.

The jargon test

Read each bullet point and ask yourself: "Would my non-technical friend understand this?" If the answer is no, rewrite it. Words like "PHI," "MFA," and "endpoint" need to be either spelled out or replaced with plain language.

Document running longer than one page?

Cut adjectives and filler phrases first. Replace two-sentence bullets with one-sentence bullets. If still too long, reduce Key Findings from 4 bullets to 3.

Help me shorten my executive risk summary to one page without losing the key messages.

Your completed executive summary should have five clearly labeled sections: Purpose, Methodology, Key Findings, Recommendations, and Risk Acceptance Statement. Each section is concise and written for someone who makes business decisions, not technical ones.

Secret mission

Map Risks to NIST CSF 2.0 Controls

You have a scored risk register and a heat map that tells leadership where the danger zones are. But a senior GRC analyst goes one step further. They connect each risk to the specific framework category that addresses it, then recommend a concrete control. This is the skill that separates entry-level from mid-level GRC roles.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely in Google Sheets and Google Docs, so there are no ongoing costs.

Resources you used:

MedVault Risk Register Google Sheets spreadsheet (Risk Register tab and Heat Map tab).
MedVault Executive Risk Summary Google Docs document.

Keep everything running

No action needed. Choose this if you want to continue refining your risk register, add more risks, or use these documents as templates for future assessments.

Your Google Sheets and Google Docs files remain in your Google Drive at no cost.
You can share them with hiring managers or include links in your portfolio.

Pause - I'll come back to this later

Move your files out of your main Drive view so they do not clutter your workspace. You can return to them anytime.

In Google Drive, create a folder called GRC Portfolio.
Move both MedVault Risk Register and MedVault Executive Risk Summary into that folder.
This keeps your Drive tidy while preserving your work for later.

Delete - I don't want to use this again

Remove all project files from your Google Drive permanently.

Open Google Drive at drive.google.com.
Right-click MedVault Risk Register and select Move to trash.
Right-click MedVault Executive Risk Summary and select Move to trash.
Open Trash from the left sidebar, then click Empty trash to permanently delete both files.

Nice Work!

Nice work! You just completed a full cybersecurity risk assessment for a healthcare startup, producing the exact deliverables that GRC hiring managers look for in candidate portfolios.

You've learned how to:

Build a structured risk register with 12 cybersecurity risks scored using a 5x5 risk matrix, including treatment decisions (accept, mitigate, transfer, avoid) with documented justifications.
Create a color-coded risk heat map that communicates MedVault's risk posture at a glance.
Write a one-page executive risk summary that translates technical risks into business language a CEO can act on in under two minutes.
Secret Mission: Map your top risks to specific NIST CSF 2.0 categories and recommend controls, demonstrating cross-framework thinking.

Ready to quiz yourself?