FREE · CLAUSE-MAPPED · CSV DOWNLOAD

Pre-populated risk registers auditors will accept

6 framework registers · 155 pre-populated risks · every row scored on a 5×5 inherent + residual matrix and mapped to a specific clause (Annex A, TSC CC1–CC9, §164.308–§164.312, GDPR Articles 5–44, PCI DSS 4.0.1 12.3.1 TRA, CSF 2.0). Drop into your ISMS — keep the rows that fit, edit the rest.

Browse registers Run free audit
6
Frameworks
155
Pre-populated risks
5×5
Scoring matrix
CSV
Editable export
ISO 27001:2022 Risk Register (Annex A mapped)
30 rows
30-row ISO 27001:2022 risk register pre-mapped to Annex A controls — inherent + residual L×I scoring, treatment, owner, control reference. Use for Clause 6.1.2 risk assessment evidence.
Open register →
SOC 2 Risk Register (TSC CC1–CC9 mapped)
28 rows
28-row SOC 2 risk register pre-mapped to 2017 Trust Services Criteria CC1–CC9. Inherent + residual scoring, owner, control reference. Required evidence for CC3.1 risk assessment.
Open register →
HIPAA Risk Analysis Register (§164.308(a)(1)(ii)(A))
25 rows
25-row HIPAA risk analysis register pre-mapped to Security Rule §164.308–§164.312. Required for OCR investigation evidence; covers PHI at rest, in transit, and in motion.
Open register →
GDPR Risk Register & DPIA Source
26 rows
26-row GDPR risk register pre-mapped to Articles 5, 6, 25, 28, 30, 32, 33, 35, 44. Use as DPIA input or Article 32 evidence.
Open register →
PCI DSS 4.0.1 Risk Register (Targeted Risk Analysis)
22 rows
22-row PCI DSS 4.0.1 risk register supporting Requirement 12.3.1 Targeted Risk Analysis. Maps each risk to its requirement; ready for QSA evidence.
Open register →
NIST CSF 2.0 Risk Register (Govern → Recover)
24 rows
24-row NIST CSF 2.0 risk register covering all 6 functions (Govern, Identify, Protect, Detect, Respond, Recover). Inherent + residual scoring, function/category reference.
Open register →

A register isn't evidence — controls are.

Once your register is in place, run a free 60-second ComplianceIQ audit on your existing policies and we'll score every control gap against the framework — no signup required.

Run a free audit