Risk Register: GCT

Risk Register

27

Total risks

3

High residual risk

7.6

Avg residual score

19

Open (unmitigated)

View:

Risk heat map: Residual scores

Likelihood →

Impact →

Access Control

3 risks

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Weak or Shared Passwords	16 (L4×I4)	Mitigate	4 (L2×I2)	In progress	James Holden IT Manager	06 Jun 2026	Cyber Essentials IASME Cyber Assurance
Excessive Privilege	15 (L3×I5)	Mitigate	3 (L1×I3)	In progress	Naomi Nagata IT Manager	06 May 2026	Cyber Essentials IASME Cyber Assurance
Multi-Factor Authentication Not Enforced	16 (L4×I4)	Mitigate	4 (L2×I2)	In progress	Alex Kamal IT Manager	06 Apr 2026	Cyber Essentials IASME Cyber Assurance

Malware & Ransomware

3 risks

1 HIGH

3 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Ransomware Attack	20 (L4×I5)	Accept	20 (L4×I5)	Open	-	-	Cyber Essentials IASME Cyber Assurance
Malware via Email or Malicious Link	12 (L4×I3)	Accept	12 (L4×I3)	Open	-	-	Cyber Essentials IASME Cyber Assurance
Supply Chain Software Compromise	10 (L2×I5)	Accept	10 (L2×I5)	Open	-	-	IASME Cyber Assurance

Patching & Updates

2 risks

1 HIGH

2 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Unpatched Operating Systems	16 (L4×I4)	Accept	16 (L4×I4)	Open	-	-	Cyber Essentials IASME Cyber Assurance
Unpatched Third-Party Applications	12 (L4×I3)	Accept	12 (L4×I3)	Open	-	-	Cyber Essentials IASME Cyber Assurance

Network Security

3 risks

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Insecure Remote Access	12 (L3×I4)	Mitigate	2 (L1×I2)	In progress	Alex Kamal IT Manager	06 Apr 2026	Cyber Essentials IASME Cyber Assurance
Misconfigured Firewall or Network Boundary	8 (L2×I4)	Mitigate	2 (L1×I2)	In progress	James Holden IT Manager	06 Jun 2026	Cyber Essentials IASME Cyber Assurance
Insecure Wireless Networks	9 (L3×I3)	Mitigate	1 (L1×I1)	In progress	Naomi Nagata IT Manager	06 May 2026	Cyber Essentials IASME Cyber Assurance

Data & Privacy

3 risks

2 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Data Breach or Exfiltration	15 (L3×I5)	Mitigate	8 (L2×I4)	Open	Sadavir Errinwright Compliance Officer	06 Jan 2026	IASME Cyber Assurance GDPR / UK DPA
GDPR / Data Protection Non-Compliance	8 (L2×I4)	Accept	3 (L1×I3)	Accepted	Chrisjen Avasarala Compliance Officer	06 Apr 2026	IASME Cyber Assurance GDPR / UK DPA
Accidental Internal Data Disclosure	9 (L3×I3)	Mitigate	4 (L2×I2)	Open	Camina Drummer Compliance Officer	06 Mar 2026	IASME Cyber Assurance GDPR / UK DPA

Physical Security

3 risks

2 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Unauthorised Physical Access to IT Systems	6 (L2×I3)	Mitigate	2 (L1×I2)	Open	Sadavir Errinwright Compliance Officer	06 Feb 2026	Cyber Essentials IASME Cyber Assurance
Loss or Theft of Device	9 (L3×I3)	Accept	4 (L2×I2)	Accepted	Chrisjen Avasarala Compliance Officer	06 Jan 2026	Cyber Essentials IASME Cyber Assurance
Insecure Disposal of Hardware or Media	6 (L2×I3)	Mitigate	2 (L1×I2)	Open	Camina Drummer Compliance Officer	06 Apr 2026	Cyber Essentials IASME Cyber Assurance

Third Party

3 risks

3 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Third-Party Supplier Security Breach	12 (L3×I4)	Accept	12 (L3×I4)	Open	-	-	IASME Cyber Assurance
Insecure Third-Party Integration or API	6 (L2×I3)	Accept	6 (L2×I3)	Open	-	-	IASME Cyber Assurance
Inadequate Supplier Security Contractual Controls	9 (L3×I3)	Accept	9 (L3×I3)	Open	-	-	IASME Cyber Assurance

People & Awareness

4 risks

1 HIGH

4 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Phishing and Social Engineering	15 (L5×I3)	Accept	15 (L5×I3)	Open	-	-	Cyber Essentials IASME Cyber Assurance
Insider Threat	8 (L2×I4)	Accept	8 (L2×I4)	Open	-	-	IASME Cyber Assurance
Inadequate Security Awareness Training	9 (L3×I3)	Accept	9 (L3×I3)	Open	-	-	Cyber Essentials IASME Cyber Assurance
Unmanaged Personal Devices (BYOD)	9 (L3×I3)	Accept	9 (L3×I3)	Open	-	-	Cyber Essentials IASME Cyber Assurance

Business Continuity

3 risks

3 open

Risk0	Inherent	Treatment	Residual	Status	Owner	Last reviewed	Framework
Inadequate Backup and Recovery	12 (L3×I4)	Accept	12 (L3×I4)	Open	-	-	IASME Cyber Assurance
No Tested Disaster Recovery Plan	8 (L2×I4)	Accept	8 (L2×I4)	Open	-	-	IASME Cyber Assurance
Absence of Incident Response Plan	9 (L3×I3)	Accept	9 (L3×I3)	Open	-	-	IASME Cyber Assurance