Risk Register

Inherent vs residual scoring across the demo risk register.

Critical Inherent (20+)

Under Active Mitigation

10.2 → 4.7

Avg Inherent → Residual

Total Risks

ID	Title	Category	Inherent	Residual	Status	Treatment	Owner
RSK-001	Third-Party Payment Processor BreachRisk of data breach through payment processing partner Stripe leading to exposure of customer financial data and PCI non-compliance.	Third-Party	20	8	Mitigating	mitigate	CISO
RSK-002	Ransomware Attack on Production InfrastructureRisk of ransomware infection disrupting production services and encrypting customer data hosted on AWS infrastructure.	Technical	15	6	Mitigating	mitigate	Security Operations Lead
RSK-003	Failure to Achieve SOC 2 Certification by Target DateRisk of missing the Q3 2026 SOC 2 audit window, delaying enterprise sales pipeline and impacting revenue targets.	Compliance	12	6	Mitigating	mitigate	CISO
RSK-004	Insider Threat - Privileged User Data ExfiltrationRisk of a privileged employee or contractor exfiltrating sensitive customer financial data.	Operational	10	4	Mitigating	mitigate	CISO
RSK-005	API Authentication Bypass VulnerabilityRisk of undiscovered vulnerability in PayFlow API authentication mechanism allowing unauthorized access to customer financial data.	Technical	12	6	Mitigating	mitigate	Security Engineering Lead
RSK-006	Key Personnel DepartureRisk of losing critical security and engineering staff affecting institutional knowledge and compliance program continuity.	Operational	9	6	Assessed	mitigate	VP of People
RSK-007	Cloud Service Provider OutageRisk of extended AWS outage impacting availability of PayFlow API and customer-facing services beyond SLA commitments.	Technical	8	3	Accepted	accept	VP Engineering
RSK-008	Regulatory Change Impact - State Privacy LawsRisk of new state-level privacy regulations requiring significant platform modifications to meet varying data residency and consent requirements.	Compliance	9	4	Assessed	mitigate	General Counsel
RSK-009	Physical Office Security BreachRisk of unauthorized physical access to Austin HQ office resulting in theft of employee devices or exposure of sensitive information.	Operational	3	2	Accepted	accept	Facilities Manager
RSK-010	Open Source License Compliance ViolationRisk of inadvertent use of open source components with incompatible licenses in commercial SaaS product, leading to legal exposure.	Compliance	4	2	Mitigating	mitigate	Engineering Manager

Synthetic demo register - the same 10 rows the dashboard heatmap renders, so the two views cannot disagree. Inherent = likelihood x impact before treatment; residual = after the recorded mitigations. Risks you add here score residual = inherent until a treatment is recorded, and live in this browser session only (no persistence in the demo).