How does a security risk register support governance?

• A. It tracks only payroll costs
• B. It catalogs risks, owners, likelihood, impact, and mitigation status to enable informed decision-making.
• C. It stores encryption keys
• D. It schedules meetings

Answer: (B)

A security risk register supports governance by giving a centralized, structured view of the organization’s risk landscape. It catalogs each risk with details such as the owner, likelihood, potential impact, and the current status of mitigation efforts. This organized snapshot lets governance bodies see which risks matter most, who is responsible for addressing them, how effective the controls are, and what actions are still needed. With that visibility, leadership can prioritize resources, make informed decisions about risk tolerance and remediation, and monitor residual risk over time. It also provides a clear audit trail and consistent reporting for boards and regulators.

For example, a high-risk supplier risk would show the owner responsible for oversight, a high likelihood and impact assessment, and the mitigation steps in progress, enabling governance to track progress and escalate if needed.

Other options like focusing on payroll costs, storing encryption keys, or merely scheduling meetings do not provide this ongoing, decision-ready view of risk and responsibility that governance requires.