Risk Register: GCT

Total risks

High residual risk

Avg residual score

Open (unmitigated)

View:

Risk heat map: Residual scores

Likelihood →

Impact →

Access Control

3 risks

1 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Weak or Shared Passwords	16 (L4×I4)	Mitigate	6 (L2×I3)	Open	James Holden IT Manager	06 Jul 2026	Cyber Essentials IASME Cyber Assurance
Excessive Privilege	15 (L3×I5)	Mitigate	4 (L1×I4)	In progress	Naomi Nagata IT Manager	06 Jun 2026	Cyber Essentials IASME Cyber Assurance
Multi-Factor Authentication Not Enforced	16 (L4×I4)	Mitigate	6 (L2×I3)	In progress	Alex Kamal IT Manager	06 May 2026	Cyber Essentials IASME Cyber Assurance

Malware & Ransomware

3 risks

1 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Ransomware Attack	20 (L4×I5)	Mitigate	8 (L2×I4)	In progress	James Holden IT Manager	06 Apr 2026	Cyber Essentials IASME Cyber Assurance
Malware via Email or Malicious Link	12 (L4×I3)	Mitigate	4 (L2×I2)	In progress	Naomi Nagata IT Manager	06 Mar 2026	Cyber Essentials IASME Cyber Assurance
Supply Chain Software Compromise	10 (L2×I5)	Mitigate	4 (L1×I4)	Open	Alex Kamal IT Manager	06 Feb 2026	IASME Cyber Assurance

Patching & Updates

2 risks

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Unpatched Operating Systems	16 (L4×I4)	Mitigate	6 (L2×I3)	In progress	James Holden IT Manager	06 Jul 2026	Cyber Essentials IASME Cyber Assurance
Unpatched Third-Party Applications	12 (L4×I3)	Mitigate	4 (L2×I2)	In progress	Naomi Nagata IT Manager	06 Jun 2026	Cyber Essentials IASME Cyber Assurance

Network Security

3 risks

1 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Insecure Remote Access	12 (L3×I4)	Mitigate	3 (L1×I3)	In progress	Alex Kamal IT Manager	06 May 2026	Cyber Essentials IASME Cyber Assurance
Misconfigured Firewall or Network Boundary	8 (L2×I4)	Mitigate	3 (L1×I3)	In progress	James Holden IT Manager	06 Apr 2026	Cyber Essentials IASME Cyber Assurance
Insecure Wireless Networks	9 (L3×I3)	Mitigate	2 (L1×I2)	Open	Naomi Nagata IT Manager	06 Mar 2026	Cyber Essentials IASME Cyber Assurance

Data & Privacy

3 risks

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Data Breach or Exfiltration	15 (L3×I5)	Mitigate	4 (L1×I4)	In progress	Alex Kamal IT Manager	06 Feb 2026	IASME Cyber Assurance GDPR / UK DPA
GDPR / Data Protection Non-Compliance	8 (L2×I4)	Mitigate	3 (L1×I3)	In progress	James Holden IT Manager	06 Jul 2026	IASME Cyber Assurance GDPR / UK DPA
Accidental Internal Data Disclosure	9 (L3×I3)	Mitigate	2 (L1×I2)	In progress	Naomi Nagata IT Manager	06 Jun 2026	IASME Cyber Assurance GDPR / UK DPA

Physical Security

3 risks

1 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Unauthorised Physical Access to IT Systems	6 (L2×I3)	Mitigate	2 (L1×I2)	In progress	Alex Kamal IT Manager	06 May 2026	Cyber Essentials IASME Cyber Assurance
Loss or Theft of Device	9 (L3×I3)	Mitigate	2 (L1×I2)	Open	James Holden IT Manager	06 Apr 2026	Cyber Essentials IASME Cyber Assurance
Insecure Disposal of Hardware or Media	6 (L2×I3)	Mitigate	2 (L1×I2)	In progress	Naomi Nagata IT Manager	06 Mar 2026	Cyber Essentials IASME Cyber Assurance

Third Party

3 risks

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Third-Party Supplier Security Breach	12 (L3×I4)	Transfer	6 (L2×I3)	Accepted	Filip Inaros Operations Lead	06 Apr 2026	IASME Cyber Assurance
Insecure Third-Party Integration or API	6 (L2×I3)	Transfer	2 (L1×I2)	Accepted	Fred Johnson Operations Lead	06 Jun 2026	IASME Cyber Assurance
Inadequate Supplier Security Contractual Controls	9 (L3×I3)	Transfer	4 (L2×I2)	Accepted	Anderson Dawes Operations Lead	06 May 2026	IASME Cyber Assurance

People & Awareness

4 risks

2 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Phishing and Social Engineering	15 (L5×I3)	Accept	12 (L4×I3)	Accepted	-	-	Cyber Essentials IASME Cyber Assurance
Insider Threat	8 (L2×I4)	Mitigate	4 (L1×I4)	Open	Bobbie Draper Head of IT	06 Apr 2026	IASME Cyber Assurance
Inadequate Security Awareness Training	9 (L3×I3)	Accept	6 (L2×I3)	Accepted	-	-	Cyber Essentials IASME Cyber Assurance
Unmanaged Personal Devices (BYOD)	9 (L3×I3)	Mitigate	6 (L2×I3)	Open	Clarissa Mao Head of IT	06 Feb 2026	Cyber Essentials IASME Cyber Assurance

Business Continuity

3 risks

1 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Inadequate Backup and Recovery	12 (L3×I4)	Accept	8 (L2×I4)	Accepted	-	-	IASME Cyber Assurance
No Tested Disaster Recovery Plan	8 (L2×I4)	Mitigate	4 (L1×I4)	Open	Amos Burton Head of IT	06 May 2026	IASME Cyber Assurance
Absence of Incident Response Plan	9 (L3×I3)	Accept	6 (L2×I3)	Accepted	-	-	IASME Cyber Assurance