What is the role of an information security risk register?

• A. To document identified risks, assessment results, owners, controls, and remediation status.
• B. To quantify annual IT budget and allocate resources.
• C. To store user login credentials for auditors.
• D. To ensure hardware inventory is updated in real time.

Answer: (A)

The main idea being tested is how an information security risk register functions as a governance tool for risk management. A risk register is a living document that records each identified information security risk, the results of its assessment (likelihood and impact), who owns the risk, the controls currently in place, and the remediation status. This structure provides a clear picture of the risk landscape, helps prioritize which risks to treat first based on severity, and tracks progress over time with assigned owners and due dates. It supports informed decision-making by management and aligns with standards and audits by showing that risks are identified, analyzed, and actively managed.

This isn’t about budgeting IT spend, storing credentials, or managing real-time hardware inventories. Budgeting is a financial process, storing login credentials is a security vulnerability, and real-time inventory management is a separate asset management function. The risk register’s purpose is precisely to document and monitor risks, along with responsibilities and mitigation steps.