ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A risk register is the authoritative list of known risks and their current status. When a new threat or vulnerability is identified, the organization should create or update a separate risk item that captures a clear description of the issue, its likelihood and impact, the affected asset, the assigned risk owner, and the planned treatment date. This lets management track mitigation progress and reassess priority during the next review. Deleting earlier entries, recording the issue only in a change-management system, or changing the enterprise-wide risk appetite fails to provide adequate visibility or accountability for this specific vulnerability.