Build a Risk Register for a SaaS Company

Build a professional GRC risk register and heat map for a fictional SaaS company.

Introduction

30 Second Summary

Every company worries about what could go wrong. A data breach, a compliance failure, a critical employee leaving with no backup plan.

In this project, you will step into the role of a GRC (Governance, Risk, and Compliance) analyst at a fictional SaaS startup and build a complete risk register from scratch. You'll identify cybersecurity risks, score them using the industry-standard 5x5 matrix, and create a visual heat map that communicates priorities to leadership.

What You'll Build

You'll create a multi-sheet Google Sheets workbook containing scoring criteria, a risk register with 8 fully documented risks, and a color-coded 5x5 risk heat map for a fictional B2B SaaS company called CloudTasker.

By the end of this project, you'll have:

A completed risk register with 8 documented risks covering all six NIST CSF 2.0 functions, complete with inherent scores, existing controls, residual scores, and treatment plans.
A 5x5 risk heat map with conditional formatting that visually plots your risks by severity for executive-level communication.
Working knowledge of the CIA triad, risk scoring, and how real GRC analysts identify and treat cybersecurity risks.
Secret Mission: Add a vendor risk assessment for a third-party payment processor, complete with a risk treatment escalation recommendation to leadership.

Are there any prerequisites?

No prior GRC or cybersecurity experience is needed. This project includes all foundational concepts (CIA triad, NIST CSF 2.0 functions, risk scoring) and teaches them as you build.

Set Up Your GRC Workbook

Every risk assessment needs a structured foundation. Without consistent scoring criteria and organized documentation, two analysts could look at the same risk and reach completely different conclusions about its severity.

In this step, you'll create the CloudTasker Risk Register workbook in Google Sheets and build the structural foundation that keeps your risk assessments consistent and professional.

In this step, get ready to:

Create a Google Sheets workbook with three organized sheets.
Build standardized scoring criteria for likelihood and impact.
Set up Risk Register column headers for documenting risks.

Create your workbook and sheets

Your workbook needs three separate sheets to keep things organized. One holds your scoring reference tables, one holds the actual risk documentation, and one will become your visual heat map.

Open your browser and go to sheets.google.com.
Click the Blank option (the large + icon) to create a new spreadsheet.
Click Untitled spreadsheet in the top-left corner and type CloudTasker Risk Register to name your workbook.
At the bottom of the screen, double-click the existing sheet tab (named Sheet1) and rename it to Scoring Criteria.
Click the + icon at the bottom-left of the screen to add a new sheet.
Double-click the new tab and rename it to Risk Register.
Click the + icon again to add a third sheet.
Double-click the new tab and rename it to Heat Map.

You should now see three tabs at the bottom of your screen: Scoring Criteria, Risk Register, and Heat Map.

Don't see all three tabs?

Make sure you pressed Enter after typing each tab name. If a tab still shows the default name (like Sheet2), double-click the tab text again to edit it.

Help me rename my sheet tabs in Google Sheets.

Build your scoring criteria tables

Scoring criteria are the ruler you measure every risk against. Without predefined scales, "high likelihood" could mean anything from 10% to 90% depending on who is scoring.

Click the Scoring Criteria tab at the bottom of the screen to switch to that sheet.
In cell A1, type Likelihood Scale as your first table title.
In row 2, add the column headers: type Score in A2, Label in B2, and Definition in C2.

Now fill in the five rows of your Likelihood Scale, starting in row 3:

Row 3: Score 1, Label Rare, Definition Less than 5% chance in 12 months.
Row 4: Score 2, Label Unlikely, Definition 5-20% chance in 12 months.
Row 5: Score 3, Label Possible, Definition 20-50% chance in 12 months.
Row 6: Score 4, Label Likely, Definition 50-80% chance in 12 months.
Row 7: Score 5, Label Almost Certain, Definition Greater than 80% chance in 12 months.

Why use a 5-point scale?

The 5x5 likelihood-by-impact matrix is the industry default for risk scoring. It is simple enough for non-specialists to use but granular enough to meaningfully differentiate between risks.

Each score maps to a specific probability range so that different analysts scoring the same risk will arrive at the same number.

Now build the Impact Scale table below the Likelihood Scale. Leave a blank row for spacing.

In cell A9, type Impact Scale as your second table title.
In row 10, add the column headers: Score in A10, Label in B10, Financial Impact in C10, and Operational Impact in D10.

Fill in the five rows of your Impact Scale, starting in row 11:

Row 11: Score 1, Label Negligible, Financial Impact Less than $10K loss, Operational Impact Minor inconvenience, workaround available.
Row 12: Score 2, Label Minor, Financial Impact $10K-$100K loss, Operational Impact Limited service degradation, resolved within hours.
Row 13: Score 3, Label Moderate, Financial Impact $100K-$500K loss, Operational Impact Significant service disruption, resolved within days.
Row 14: Score 4, Label Major, Financial Impact $500K-$2M loss, Operational Impact Severe outage affecting most customers.
Row 15: Score 5, Label Catastrophic, Financial Impact Greater than $2M loss, Operational Impact Complete service failure, potential business closure.

What is inherent vs. residual risk?

You'll use these scales to score each risk twice. Inherent risk is your exposure before any controls exist. Residual risk is what remains after your controls are in place.

The gap between the two shows whether your controls are actually working. This is a core concept you'll apply when scoring risks in a later step.

Your Scoring Criteria sheet should now have two complete reference tables with clearly defined scales.

Tables look cramped or hard to read?

Widen column C (and D for the Impact table) by dragging the column border in the header row. This makes the definitions easier to read. You can also bold row 2 and row 10 to make your headers stand out.

Help me format my scoring criteria tables in Google Sheets.

Set up your Risk Register headers

The Risk Register sheet is where you'll document every identified risk. Each column captures a specific piece of information that a GRC analyst needs to track, from the risk description through to its treatment plan.

Click the Risk Register tab at the bottom of the screen.
Starting in cell A1, enter each of these 14 column headers across row 1 (one header per cell, from A1 through N1):

A1: Risk ID.
B1: Risk Description.
C1: NIST CSF Function.
D1: Category.
E1: Inherent Likelihood (1-5).
F1: Inherent Impact (1-5).
G1: Inherent Risk Score.
H1: Existing Controls.
I1: Residual Likelihood (1-5).
J1: Residual Impact (1-5).
K1: Residual Risk Score.
L1: Risk Owner.
M1: Treatment Strategy.
N1: Status.

What do these columns mean?

Each column serves a specific purpose in the risk assessment lifecycle. Risk ID gives each risk a unique reference number. NIST CSF Function maps the risk to a standard cybersecurity framework category.

The inherent columns capture risk before controls. The residual columns capture risk after controls. Treatment Strategy records your plan for addressing each risk. You'll fill all of these in over the next few steps.

Select all 14 header cells (A1 through N1) and bold them using Cmd+B (macOS) or Ctrl+B (Windows).

Your Risk Register sheet should now show 14 bold headers spanning columns A through N.

Headers don't fit in the cells?

Some headers are long. Select all columns, then go to Format > Wrapping > Wrap to make text wrap within cells. You can also double-click any column border in the header row to auto-fit the width.

Help me fix my column widths in Google Sheets.

✔️ Awesome, I've got everything!

Great. Double check you have all three sheets set up: Scoring Criteria (with both tables), Risk Register (with 14 headers), and Heat Map (blank for now).

ⓧ I'd like to double check my setup

Here is what each sheet should contain at this point:

Scoring Criteria sheet:

Row 1: "Likelihood Scale" title.
Row 2: Headers (Score, Label, Definition).
Rows 3-7: Scores 1 through 5 with labels (Rare, Unlikely, Possible, Likely, Almost Certain) and percentage definitions.
Row 8: Blank spacer row.
Row 9: "Impact Scale" title.
Row 10: Headers (Score, Label, Financial Impact, Operational Impact).
Rows 11-15: Scores 1 through 5 with labels (Negligible, Minor, Moderate, Major, Catastrophic) and impact descriptions.

Risk Register sheet:

Row 1: 14 bold headers from Risk ID (A1) through Status (N1).
No data rows yet.

Heat Map sheet:

Empty. You will build this in a later step.

Your workbook structure is ready. Next up, you'll learn the foundational concepts (the CIA triad and NIST CSF 2.0) that drive every risk you'll add to this register.

Learn the Foundations

Your workbook is set up with scoring scales and a structured register ready to hold risks. Before you start identifying and documenting risks, you need a shared language for talking about security threats.

In this step, you will learn the two foundational frameworks that GRC analysts use every day: the CIA triad (what security protects) and NIST CSF 2.0 (how to organize your cybersecurity program). These two models will drive every decision you make in the risk register.

In this step, get ready to:

Learn the CIA triad and how it applies to CloudTasker's data and systems.
Understand all six NIST CSF 2.0 functions and their purposes.
Map CloudTasker's business context to real cybersecurity concerns.

Understand the CIA triad

Every cybersecurity risk threatens at least one of three properties of information. These three properties make up the CIA triad: Confidentiality, Integrity, and Availability.

For every risk you identify later in this project, you will ask: "Does this threaten the confidentiality, integrity, or availability of our data or systems?"

What is the CIA triad?

Confidentiality means only authorized people can access information. A breach of confidentiality at CloudTasker would look like customer data being exposed to someone who should not see it.

Integrity means data has not been tampered with or modified without authorization. A breach of integrity at CloudTasker would look like customer project data being silently changed during a database migration.

Availability means systems and data are accessible when needed. A breach of availability at CloudTasker would look like service downtime preventing customers from accessing their projects.

Take a moment to think about which of the three properties matters most to CloudTasker's enterprise clients.
Consider that a single risk can threaten more than one property at the same time.

CIA in interviews

When interviewers ask "What is the CIA triad?", they want more than definitions. Always follow up with a concrete example from the system you are discussing, exactly as you just practiced with CloudTasker.

Understand the six NIST CSF 2.0 functions

Now that you know what security protects (CIA), you need a framework for organizing how you protect it. NIST CSF 2.0 provides six functions that cover the full lifecycle of cybersecurity.

Every risk you add to your register will map to one of these six functions. Look at the "NIST CSF Function" column in your Risk Register sheet. That column is where these functions will appear.

What are the six NIST CSF 2.0 functions?

NIST defines these six functions as the highest level of organization for cybersecurity outcomes. Each function has a two-letter abbreviation you will use in the register.

Govern (GV) — establish and monitor the organization's cybersecurity risk management strategy, expectations, and policy.
Identify (ID) — help determine the current cybersecurity risk to the organization by understanding its assets and related risks.
Protect (PR) — use safeguards to prevent or reduce cybersecurity risk, such as access control and encryption.
Detect (DE) — find and analyze possible cybersecurity attacks and compromises through monitoring.
Respond (RS) — take action regarding a detected cybersecurity incident, including containment and communication.
Recover (RC) — restore assets and operations that were impacted by a cybersecurity incident.

Why does Govern come first?

Govern is a cross-cutting function introduced in CSF 2.0 (it did not exist in version 1.1). It provides outcomes that inform how an organization will achieve and prioritize the outcomes of the other five functions. Think of it as the "strategy layer" that sits above everything else.

Review the six functions one more time and notice the logical flow: set strategy (Govern), understand what you have (Identify), lock it down (Protect), watch for attacks (Detect), handle incidents (Respond), and get back to normal (Recover).

Think about CloudTasker's business context

Frameworks and models only become useful when you apply them to a real environment. Before you start identifying specific risks, you need a clear picture of what CloudTasker is, what it stores, and why certain threats would hurt more than others.

Who is CloudTasker?

CloudTasker is a B2B SaaS startup that provides project management software to enterprise clients. It stores sensitive client data including project plans, client names, and financial information.

Hosting: AWS cloud infrastructure.
Integrations: Slack for team communication and a third-party payment processor.
Team size: 45 employees.
Compliance: Preparing for its first SOC 2 Type II audit.

This business context drives which risks matter most. A company storing enterprise client data has very different priorities than a consumer photo-sharing app.

Think about how the CIA triad maps to CloudTasker's situation: customer data exposure is a confidentiality concern, data tampering during migrations is an integrity concern, and service outages are an availability concern.
Consider how the SOC 2 Type II preparation adds pressure. Enterprise clients will require proof that CloudTasker manages risk formally.

Why does SOC 2 matter here?

SOC 2 Type II is an audit that evaluates whether a company's security controls actually work over time (typically 6-12 months). Enterprise clients often require SOC 2 compliance before signing contracts. The risk register you are building is one of the core artifacts an auditor would review.

You now have the conceptual toolkit every GRC analyst needs: the CIA triad tells you what is at stake, NIST CSF 2.0 tells you how to organize your response, and CloudTasker's context tells you where to focus. Next up, you will put these frameworks to work by identifying and documenting real risks in your register.

Identify and Document Risks

You now understand the CIA triad, the six NIST CSF 2.0 functions, and CloudTasker's business context. It is time to put that knowledge to work.

In this step, you will identify eight cybersecurity risks that a real GRC analyst might flag for a SaaS startup like CloudTasker. Each risk gets documented in the "If... then..." format so that both the threat event and its business consequence are crystal clear.

In this step, get ready to:

Identify four risks by thinking through common SaaS threat categories.
Identify four more risks that cover additional NIST CSF functions.

Identify and document your first four risks

A good starting point for risk identification is to think through common SaaS threat categories. Ask yourself: what could threaten the confidentiality, integrity, or availability of CloudTasker's data and systems?

Why use the "If... then..." format?

Writing risks as "If [threat event], then [business consequence]" forces you to be specific about both the cause and the impact. Vague risks like "data breach" are hard to score and harder to treat.

This format is a professional best practice that keeps your register actionable. It also helps risk owners understand exactly what they are responsible for preventing.

Switch to the Risk Register sheet tab at the bottom of your workbook.
In Row 2, enter the following values across the first four columns:

Risk ID: R-001
Risk Description: If an employee's credentials are compromised through phishing, then an attacker could access customer data
NIST CSF Function: Protect (PR)
Category: Cybersecurity

Why does this map to Protect (PR)?

Phishing exploits a gap in safeguards like access controls and security awareness training. The Protect function covers preventive controls that reduce the likelihood or impact of adverse events.

In Row 3, enter your second risk:

Risk ID: R-002
Risk Description: If CloudTasker's AWS environment is misconfigured, then sensitive data could be publicly exposed
NIST CSF Function: Protect (PR)
Category: Technology

In Row 4, enter your third risk:

Risk ID: R-003
Risk Description: If a ransomware attack encrypts production databases, then service availability is lost for all customers
NIST CSF Function: Detect (DE)
Category: Cybersecurity

Why does ransomware map to Detect (DE)?

Ransomware succeeds when it goes undetected long enough to spread. The Detect function covers the monitoring and analysis capabilities that catch attacks early. Without detection controls, ransomware encrypts everything before anyone notices.

In Row 5, enter your fourth risk:

Risk ID: R-004
Risk Description: If CloudTasker fails to meet SOC 2 compliance requirements, then enterprise clients may terminate contracts
NIST CSF Function: Govern (GV)
Category: Compliance

Why does compliance map to Govern (GV)?

The Govern function sets risk management strategy and policy at the organizational level. Failing a compliance audit is a governance failure. It means leadership did not establish the right policies and oversight to meet regulatory expectations.

You should now see four rows of data in your Risk Register sheet. Notice how each risk targets a different aspect of CloudTasker's security posture.

Connect each risk to the CIA triad

R-001 threatens confidentiality (unauthorized access to customer data). R-002 also threatens confidentiality (public data exposure). R-003 threatens availability (service lost for all customers). R-004 threatens business operations through compliance failure.

Identify and document four more risks

Your first four risks focused heavily on the Protect function. A well-rounded risk register covers all six NIST CSF 2.0 functions. These next four risks fill in the gaps.

In Row 6, enter your fifth risk:

Risk ID: R-005
Risk Description: If a key developer leaves without knowledge transfer, then critical system maintenance is delayed
NIST CSF Function: Identify (ID)
Category: Operational

Why does key-person risk map to Identify (ID)?

The Identify function is about understanding your assets and the risks to them. People are assets. If you have not identified which individuals hold critical knowledge, you cannot protect against their departure. This is an asset management gap.

In Row 7, enter your sixth risk:

Risk ID: R-006
Risk Description: If customer data is accidentally modified during a database migration, then data integrity is compromised
NIST CSF Function: Protect (PR)
Category: Technology

In Row 8, enter your seventh risk:

Risk ID: R-007
Risk Description: If CloudTasker has no incident response plan, then breach containment takes significantly longer
NIST CSF Function: Respond (RS)
Category: Cybersecurity

In Row 9, enter your eighth and final risk:

Risk ID: R-008
Risk Description: If backup restoration has never been tested, then recovery from a disaster may fail
NIST CSF Function: Recover (RC)
Category: Technology

How do these risks cover the full NIST CSF 2.0?

Across all eight risks, you have now touched five of the six NIST CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover. The only function without a dedicated risk entry is Detect, which appears once (R-003).

In a real engagement, you would continue identifying risks until every function has meaningful coverage. For this project, eight risks give you a strong, well-distributed register to score and treat in the next step.

Your Risk Register sheet should now have 8 rows of data (Rows 2 through 9), with only the first four columns filled in for each row. The scoring and control columns remain empty for now.

Missing data or rows look off?

Make sure you are entering data starting in Row 2 (Row 1 is your headers). Each risk should occupy its own row with no blank rows in between.

If your text is getting cut off, widen the columns by dragging the column border in the header row. The Risk Description column in particular needs to be wide enough to display the full "If... then..." statement.

Help me check my risk register entries are correct.

✔️ Awesome, I've got all 8 risks documented!

Great work. Double check that you have exactly 8 rows of risk data and that each row has all four columns filled in (Risk ID, Risk Description, NIST CSF Function, Category).

ⓧ I'd like to double check my entries

Here is the complete set of data your Risk Register sheet should contain at this point. Compare your entries against this reference:

Row 2: R-001 | If an employee's credentials are compromised through phishing, then an attacker could access customer data | Protect (PR) | Cybersecurity.
Row 3: R-002 | If CloudTasker's AWS environment is misconfigured, then sensitive data could be publicly exposed | Protect (PR) | Technology.
Row 4: R-003 | If a ransomware attack encrypts production databases, then service availability is lost for all customers | Detect (DE) | Cybersecurity.
Row 5: R-004 | If CloudTasker fails to meet SOC 2 compliance requirements, then enterprise clients may terminate contracts | Govern (GV) | Compliance.
Row 6: R-005 | If a key developer leaves without knowledge transfer, then critical system maintenance is delayed | Identify (ID) | Operational.
Row 7: R-006 | If customer data is accidentally modified during a database migration, then data integrity is compromised | Protect (PR) | Technology.
Row 8: R-007 | If CloudTasker has no incident response plan, then breach containment takes significantly longer | Respond (RS) | Cybersecurity.
Row 9: R-008 | If backup restoration has never been tested, then recovery from a disaster may fail | Recover (RC) | Technology.

You have identified and documented eight risks that span multiple NIST CSF functions and threat categories. Next up, you will score each risk using your likelihood and impact scales, document existing controls, and calculate residual risk scores.

Score Your Risks and Document Controls

You have eight risks documented in your register. Right now they are descriptions without any measure of severity, which means you cannot prioritize them.

In this step, you will score each risk using your Scoring Criteria sheet, document the controls CloudTasker already has in place, and calculate the residual risk that remains after those controls. This is where your register transforms from a list of worries into an actionable decision-making tool.

In this step, get ready to:

Score inherent likelihood and impact for all 8 risks.
Document existing controls and calculate residual risk scores.
Assign risk owners, treatment strategies, and apply conditional formatting.

Score inherent likelihood and impact

Inherent risk is your exposure before any controls are in place. You are imagining a world where CloudTasker has done nothing to protect itself, then asking: how likely is this event, and how bad would it be?

Switch to the Risk Register sheet in your workbook.
Refer to your Scoring Criteria sheet to guide your scoring decisions.
Enter the following inherent likelihood and impact scores for each risk in the Inherent Likelihood (1-5) and Inherent Impact (1-5) columns:

R-001 (Phishing): Likelihood 4, Impact 4.
R-002 (AWS misconfiguration): Likelihood 3, Impact 5.
R-003 (Ransomware): Likelihood 2, Impact 5.
R-004 (SOC 2 compliance): Likelihood 3, Impact 5.
R-005 (Key developer departure): Likelihood 3, Impact 3.
R-006 (Data integrity during migration): Likelihood 3, Impact 4.
R-007 (No incident response plan): Likelihood 4, Impact 4.
R-008 (Untested backup restoration): Likelihood 4, Impact 4.

Why these specific scores?

Consider R-001 (phishing). Phishing attacks are the number one initial attack vector for data breaches, so a likelihood of 4 (Likely, 50-80% chance in 12 months) is realistic. The impact is 4 (Major) because customer data exposure triggers breach notification requirements and potential contract losses.

Compare that to R-003 (ransomware). While the impact is catastrophic if it hits (score of 5), the likelihood is lower (score of 2) because ransomware targeting a specific small SaaS company is less probable than a broad phishing campaign.

In the Inherent Risk Score column, click on the cell for R-001 (this should be column G if you followed the column order from the previous step).
Enter a formula that multiplies the Inherent Likelihood cell by the Inherent Impact cell. For example, if R-001's likelihood is in cell E2 and impact is in F2, type:

=E2*F2

Press Enter to confirm the formula.
Copy this formula down to all 8 rows (select the cell, then drag the small blue square at the bottom-right corner down through R-008).

What does this formula do?

The formula Risk Score = Likelihood x Impact is the industry-standard approach for quantifying risk on a 5x5 matrix. It produces a range of 1-25, giving you enough granularity to differentiate between risks that need immediate attention and those you can monitor over time.

Verify that R-001 shows a score of 16 (4 x 4), R-002 shows 15 (3 x 5), and R-005 shows 9 (3 x 3).

Seeing a 0 or an error in the score column?

Make sure you entered numeric values (not text like "four") in the Likelihood and Impact columns. The formula needs numbers to multiply.

If you see a #REF! error, double-check that your formula points to the correct cells. Your cell references may differ from E2*F2 depending on your column layout.

Help me fix my Inherent Risk Score formula in Google Sheets.

Document existing controls and score residual risk

Inherent risk tells you the theoretical worst case. Residual risk tells you the actual exposure that remains after CloudTasker's existing controls are factored in. The gap between the two shows whether your controls are actually working.

In the Existing Controls column, enter the following controls for each risk. These are realistic for a 45-person startup that has basic security but is still maturing:

R-001: Email spam filtering, annual security awareness training.
R-002: AWS Config rules, quarterly cloud security reviews.
R-003: Endpoint protection, offsite backups.
R-004: Compliance roadmap initiated, external auditor engaged.
R-005: Basic documentation, informal knowledge sharing.
R-006: Pre-migration backups, staging environment testing.
R-007: Ad hoc response procedures.
R-008: Automated backups configured but not tested.

How do controls change the score?

Controls typically reduce likelihood (making the event less probable) or impact (limiting the damage if it happens). Some controls reduce both. For example, email spam filtering for R-001 reduces the likelihood that a phishing email reaches an employee, but it does not reduce the impact if one gets through.

Notice that R-007 (no incident response plan) has weak controls ("ad hoc response procedures"). This means the residual likelihood stays high because informal procedures are not reliable under pressure.

Now enter the residual likelihood and impact scores in the Residual Likelihood (1-5) and Residual Impact (1-5) columns. These reflect your exposure after the existing controls are considered:

R-001: Residual Likelihood 3, Residual Impact 4.
R-002: Residual Likelihood 2, Residual Impact 5.
R-003: Residual Likelihood 2, Residual Impact 4.
R-004: Residual Likelihood 2, Residual Impact 5.
R-005: Residual Likelihood 3, Residual Impact 2.
R-006: Residual Likelihood 2, Residual Impact 3.
R-007: Residual Likelihood 4, Residual Impact 3.
R-008: Residual Likelihood 3, Residual Impact 4.

In the Residual Risk Score column, enter a formula that multiplies your Residual Likelihood by Residual Impact. For example, if R-001's residual likelihood is in cell I2 and residual impact is in J2, type:

=I2*J2

Copy the formula down to all 8 rows.
Verify that R-001 shows a residual score of 12 (3 x 4) and R-005 shows 6 (3 x 2).

What is the difference between inherent and residual risk?

Inherent risk is your exposure before any controls. Residual risk is what remains after. The gap between the two shows whether your controls are actually working.

For example, R-001 dropped from 16 (inherent) to 12 (residual). That 4-point reduction shows that email filtering and training help, but phishing remains a significant threat. A CISO looking at this gap would know that more investment in controls is needed.

Residual score is the same as inherent score?

Double-check that your Residual Risk Score formula references the residual columns (I and J, or wherever your residual values are), not the inherent columns (E and F). It is easy to accidentally copy the inherent formula without updating the cell references.

Help me fix my residual risk score formula so it references the correct columns.

Assign risk owners and apply conditional formatting

Every risk needs a named owner who is accountable for managing it. In a real organization, this is a specific role (not a department). You also need to decide how to treat each risk and track its current status.

Fill in the Risk Owner, Treatment Strategy, and Status columns for all 8 risks using the following values:

R-001: Owner CISO, Treatment Mitigate, Status Open.
R-002: Owner VP Engineering, Treatment Mitigate, Status In Progress.
R-003: Owner CISO, Treatment Mitigate, Status Open.
R-004: Owner Head of Compliance, Treatment Mitigate, Status In Progress.
R-005: Owner VP Engineering, Treatment Mitigate, Status Open.
R-006: Owner VP Engineering, Treatment Mitigate, Status Open.
R-007: Owner CISO, Treatment Mitigate, Status Open.
R-008: Owner VP Engineering, Treatment Mitigate, Status Open.

What are the four risk treatment strategies?

There are four standard approaches to treating risk: Mitigate (add controls to reduce likelihood or impact), Accept (acknowledge the risk and take no further action), Transfer (shift the risk to a third party, like cyber insurance), and Avoid (eliminate the activity that creates the risk entirely).

Most risks in a startup are treated with Mitigate because the business cannot afford to avoid the activity or accept the exposure. In practice, you would see Transfer used for high-impact risks (like purchasing cyber liability insurance for data breaches) and Accept used for low-scoring risks where the cost of mitigation exceeds the potential loss.

Now you will add conditional formatting to make risk scores visually scannable at a glance. Color-coding turns a wall of numbers into an instant priority signal.

Select all cells in the Inherent Risk Score column (just the data cells, not the header).
Click Format in the top menu bar.
Click Conditional formatting.
Add four rules, one for each risk level band:

Rule 1: Format cells if less than or equal to 5. Set the fill color to green (Low risk).
Rule 2: Format cells if between 6 and 12. Set the fill color to yellow (Medium risk).
Rule 3: Format cells if between 15 and 20. Set the fill color to orange (High risk).
Rule 4: Format cells if between 21 and 25. Set the fill color to red (Critical risk).

Setting up conditional formatting rules in Google Sheets

In the Conditional format rules panel on the right side, use the dropdown under Format cells if... to select Less than or equal to or Is between. Then set the fill color using the paint bucket icon. Click Done to save each rule, then click Add another rule for the next one.

Repeat the same four conditional formatting rules for the Residual Risk Score column. Select those cells, then apply the same green/yellow/orange/red rules.

Check your register. You should see color-coded cells in both score columns. R-001's inherent score of 16 should appear orange (High), and its residual score of 12 should appear yellow (Medium).

Colors not appearing on some cells?

Make sure the range in your conditional formatting rules covers all 8 data rows. If you only selected one cell before creating the rules, the formatting will not apply to the other rows.

Also check that there is no gap in your scoring bands (the jump from 12 to 15 is intentional because 13 and 14 are not possible results from a 5x5 matrix). Your rules cover 1-5, 6-12, 15-20, and 21-25.

Help me troubleshoot my conditional formatting rules in Google Sheets.

Your risk register is now fully scored, documented, and color-coded. Next up, you will turn these numbers into a visual heat map that communicates risk priorities at a glance to leadership.

Build the Risk Heat Map

Your Risk Register is fully scored and documented. You now have 8 risks with inherent scores, existing controls, and residual scores that tell a clear story about CloudTasker's security posture.

Numbers in a spreadsheet are powerful, but executives need to see risk at a glance. In this step, you will build a risk heat map that visually plots your risks on a color-coded grid. This is the artifact a CISO reviews in a board meeting to communicate where the organization stands.

In this step, get ready to:

Build a 5x5 grid with likelihood and impact axes.
Apply color-coded conditional formatting and place your 8 risks on the map.
Create an executive summary section showing risk distribution across severity bands.

Create the 5x5 grid structure

A 5x5 risk matrix maps likelihood on the vertical axis against impact on the horizontal axis. Each cell shows the multiplied score, making it instantly clear which combinations produce the most dangerous risks.

Switch to the Heat Map sheet tab at the bottom of your workbook.
In cell A1, type Likelihood / Impact as the corner header.
In cells B1 through F1, type the Impact column headers from left to right:

B1: 1 - Negligible.
C1: 2 - Minor.
D1: 3 - Moderate.
E1: 4 - Major.
F1: 5 - Catastrophic.

In cells A2 through A6, type the Likelihood row labels from top to bottom:

A2: 5 - Almost Certain.
A3: 4 - Likely.
A4: 3 - Possible.
A5: 2 - Unlikely.
A6: 1 - Rare.

Fill in each cell of the 5x5 grid (B2 through F6) with the multiplied score for that row and column combination. For example, the cell at Likelihood 4 and Impact 3 (cell D3) should contain 12.

Fill the grid quickly

Start with row 2 (Likelihood = 5). The values across columns B through F are: 5, 10, 15, 20, 25. Row 3 (Likelihood = 4): 4, 8, 12, 16, 20. Continue this pattern for each row. The bottom-left corner (B6) will be 1 and the top-right corner (F2) will be 25.

Why does Likelihood 5 go at the top?

The highest-likelihood risks sit at the top of the grid and the highest-impact risks sit on the right. This means the most dangerous risks (high likelihood AND high impact) cluster in the top-right corner, which is where a reader's eye naturally goes first.

Your grid should now show scores ranging from 1 in the bottom-left corner to 25 in the top-right corner.

Apply conditional formatting and place your risks

Color-coding transforms a wall of numbers into an instant visual signal. You will use the same four severity bands you applied to the Risk Register sheet.

Select the entire grid range B2:F6.
Click Format in the top menu bar.
Select Conditional formatting.
Create four conditional formatting rules, one for each severity band:

Rule 1: Format cells if Less than or equal to 5. Set fill color to green. This is your Low band.
Rule 2: Format cells if Between 6 and 12. Set fill color to yellow. This is your Medium band.
Rule 3: Format cells if Between 15 and 20. Set fill color to orange. This is your High band.
Rule 4: Format cells if Between 21 and 25. Set fill color to red. This is your Critical band.

What about rule order?

Google Sheets applies conditional formatting rules from top to bottom. Make sure your "Less than or equal to 5" rule does not override the other rules. If a cell shows the wrong color, drag rules in the conditional formatting panel so that more specific ranges (21-25, 15-20, 6-12) are listed above the broadest one (1-5).

Your grid should now display a gradient from green in the bottom-left to red in the top-right. Now you will place your Risk IDs onto the map.

Switch to the Risk Register sheet and note each risk's Residual Likelihood and Residual Impact values.
Return to the Heat Map sheet.
In each grid cell, append the Risk ID(s) that correspond to that likelihood and impact intersection. Place them after the score number, separated by a line break (Alt+Enter on Windows, Ctrl+Enter on macOS inside a cell).

Here is where each risk belongs based on residual scores:

R-001: Likelihood 3, Impact 4 (cell E4).
R-002: Likelihood 2, Impact 5 (cell F5).
R-003: Likelihood 2, Impact 4 (cell E5).
R-004: Likelihood 2, Impact 5 (cell F5).
R-005: Likelihood 3, Impact 2 (cell C4).
R-006: Likelihood 2, Impact 3 (cell D5).
R-007: Likelihood 4, Impact 3 (cell D3).
R-008: Likelihood 3, Impact 4 (cell E4).

What does the clustering tell you?

Notice that R-001 and R-008 share the same cell, and R-002 and R-004 share another. When multiple risks cluster in the same cell, it signals a concentration of exposure at that severity level. This is exactly the kind of pattern a CISO looks for.

Risk IDs in the wrong cells?

Double-check that you are using the residual likelihood and impact values, not the inherent values. The heat map shows risk after controls are applied.

Also confirm your row labels go from 5 (top) to 1 (bottom). If they are reversed, your risks will appear in the wrong row.

Help me figure out why my risk IDs are in the wrong heat map cells.

Add the executive summary section

A heat map without interpretation is just a pretty grid. The summary section translates color into action by telling leadership exactly how many risks fall into each severity band and what response is expected.

Leave a blank row below your grid for spacing. In the row below the blank (row 8 if your grid ends at row 6), create the summary section.
In cell A8, type Risk Summary and bold it.
In cell A9, type Critical Risks (21-25): Immediate action required.
In cell A10, type High Risks (15-20): Active mitigation plan needed.
In cell A11, type Medium Risks (6-12): Monitor quarterly.

Next to each row, add a count of how many of your 8 risks fall into that band. Look at the residual scores from your Risk Register sheet and count:

Critical (21-25): 0 risks. None of your residual scores reach this band.
High (15-20): 0 risks. Your controls brought every risk below the High threshold.
Medium (6-12): 8 risks. All 8 risks sit in the Medium band after controls are applied.

Enter these counts in column B next to each summary row (e.g., B9: 0, B10: 0, B11: 8).

What does this summary tell a CISO?

The fact that all 8 residual risks land in the Medium band is actually a positive signal. It means CloudTasker's existing controls have brought every risk below the High threshold. No risk requires immediate emergency action.

In a real organization, this summary tells leadership: "We have risks, but none are uncontrolled. Our quarterly monitoring cadence is appropriate." If any risk scored 15+ after controls, that would require an escalation conversation.

Not sure how to count the risk bands?

Go to the Risk Register sheet and look at the Residual Risk Score column only. Every score of 6, 8, 10, or 12 falls in the Medium band (6-12). Check that none of your residual scores accidentally exceed 12.

Help me verify my risk band counts are correct.

Your risk heat map is complete. You now have a visual communication tool that any executive can understand in seconds. Next up, the Secret Mission challenges you to go deeper with a vendor risk assessment.

Secret mission

Vendor Risk Assessment

Your risk register covers CloudTasker's internal threats. But what about the third-party services CloudTasker depends on? In this secret mission, you will assess a vendor risk for a payment processor and write an escalation recommendation to leadership.

Clean Up Your Resources

This project runs entirely in Google Sheets, so there are no ongoing costs or running processes to worry about. Decide whether to keep your workbook as a portfolio piece, or delete it if you want a fresh start.

Resources you used:

Google Sheets workbook: "CloudTasker Risk Register" (contains Scoring Criteria, Risk Register, and Heat Map sheets).

Keep everything running

No action needed. Choose this if you plan to reference or expand your risk register later.

Your Google Sheets workbook stays in your Google Drive at no cost.
You can share the workbook link on your resume or in job applications as a portfolio artifact.
Consider setting the sharing permissions to "Anyone with the link can view" so interviewers can access it without requesting permission.

Pause - I'll come back to this later

Google Sheets has no running processes to pause. Your workbook stays in Google Drive indefinitely at no cost.

No action required. Your workbook is already in a paused state by default.
When you return, open Google Drive and search for "CloudTasker Risk Register" to pick up where you left off.

Delete - I don't want to use this again

Remove the workbook from your Google Drive entirely.

Open Google Drive.
Search for or locate the file named "CloudTasker Risk Register".
Right-click the file and select Move to trash.
To permanently delete it, click Trash in the left sidebar, right-click the file, and select Delete forever.

Nice Work!

You just built a professional-grade risk register for a SaaS company from scratch. This is the exact artifact that hiring managers look for when evaluating GRC analyst candidates.

You've learned how to:

Identify and document cybersecurity risks using the CIA triad and NIST CSF 2.0 functions, then score them with a 5x5 likelihood-by-impact matrix.
Score both inherent and residual risk, assign risk owners, choose treatment strategies, and apply conditional formatting for executive-level communication.
Build a color-coded 5x5 risk heat map that visually plots risk severity and provides stakeholders with an at-a-glance summary of your organization's risk posture.
Complete a vendor risk assessment for a third-party payment processor, including an escalation recommendation to leadership (Secret Mission).

Ready to quiz yourself?