Risk Register Assessment

Introduction

How do you assess a cyber risk register?

You can assess your cyber risk register in minutes with the X-Analytics Risk Register Assessment. Upload your register, and the Agent validates it, maps every cyber entry to loss categories, risk scenarios, and CIS Safeguards, then scores its quality, coverage, and calibration against your profile. The report shows where the register is strong, where the gaps are, and which additions offer the most risk-reducing benefit.

Bob Vescio, Chief Innovation Officer, walks through the Risk Register Assessment, from uploading your register to a scored assessment report.

Key takeaways

• The Risk Register Assessment validates, maps, and scores a risk register in a few minutes, a task that can take thirty to ninety minutes by hand.
• It accepts Word, PDF, Excel, and CSV files.
• Every cyber-related entry is mapped to X-Analytics loss categories, threat and asset scenarios, and primary and secondary CIS Safeguards.
• Scoring covers register quality, coverage of your top loss categories, risk scenarios, and suppliers, and calibration against your profile.
• The report orders CIS Safeguards by remaining risk-reducing benefit, so you know which additions matter most.

What is the Risk Register Assessment?

The Risk Register Assessment is an Agent in X-Analytics that checks how well your risk register reflects your actual cyber risk. X-Analytics built it in response to customer requests to upload a risk register and see how it compares with what they measure in the platform. It’s one of a growing set of assessment agents in X-Analytics, and it gives you a register you can bring to leadership and the board with confidence.

How do you start a risk register assessment?

You can start in five steps:

1. Go to AI Tools and type “assess” to see every assessment agent.
2. Select the Risk Register Assessment and click Start Assessment.
3. Click Attach File and choose your risk register. Word, PDF, Excel, and CSV files are all supported.
4. Click Upload.
5. Click Upload and Validate.

How does the Agent validate your risk register?

The Agent first confirms the file is a risk register, rather than a list of open items or audit findings. Each validation check returns a pass, warning, or fail, with the reason behind it. The Agent also gives a confidence rating, and anything above 80% means it’s confident the file is a risk register. In the walkthrough, every check passed, one returned a warning, and the file received a 95% confidence rating. Select “Yes, proceed to mapping” to continue.

How does the Agent map your register?

The Agent reviews every entry and separates cyber-related risks from the rest. Entries outside cyber are identified and left unmapped. Each cyber-related entry is mapped to:

• One or more X-Analytics loss categories
• A combination of threat and asset scenarios
• Primary and secondary CIS Critical Security Controls v8.1 Safeguards

Observations below the mapping table highlight anything worth a closer look before scoring.

How is the risk register scored?

The Agent scores the register in four areas, with a detailed reason for every result. It also flags entries that don’t match your profile. In the walkthrough, a register from a fictional logistics company was run against a financial services profile on purpose, and the Agent flagged the mismatch.

Quality score

The quality score checks that the register has the right core fields, clear risk statements, consistent ratings, and defined ownership.

Coverage score

The coverage score measures how well the register aligns with your profile, comparing it against your top five loss categories, top five risk scenarios, and top five suppliers. In the walkthrough, the register covered 66.7% of the top loss categories. The largest gap was misappropriation of intellectual property, the second-largest loss category, which only one entry partially covered. Denial of service had no entry, which may be reasonable since it represented 2.6% of total exposure.

Calibration score

The calibration score compares the risk ratings in your register with the ratings in your profile, showing where the two agree and where they diverge.

Key controls and evidence

This section lists the CIS Safeguards that support each key control in your register, along with the evidence from your profile. It flags any control the register treats as key that your profile shows is poorly implemented, so the register reflects how well each control performs in practice.

What’s in the risk register assessment report?

The Risk Register Assessment Report brings the validation, mapping, and scoring together with a detailed reason behind every decision, so you know exactly which entries to keep and which to adjust. It includes:

• An overall rating for the register
• The full risk grid, which you can break out by loss category
• CIS Safeguards ordered by remaining risk-reducing benefit, showing which additions to the register matter most

The walkthrough register was rated as needing improvement, which is exactly what the assessment is designed to surface.

Select “Yes, create the artifact” to turn the report into a shareable artifact. You can save it to the Vault, edit it, and share it by link with people inside or outside X-Analytics.

Frequently asked questions

What does the Risk Register Assessment do?
It validates your risk register, maps every cyber-related entry to loss categories, risk scenarios, and CIS Safeguards, and scores the register’s quality, coverage, and calibration against your X-Analytics profile.

What file types can I upload?
Word, PDF, Excel, and CSV files.

How long does it take?
A few minutes. The same review can take thirty to ninety minutes by hand.

What happens to entries outside cyber?
The Agent identifies them and leaves them unmapped, so the assessment focuses on your cyber-related risks.

How does the assessment find gaps in my register?
It compares your register with your profile’s top five loss categories, risk scenarios, and suppliers, and highlights any significant exposure without a matching entry.

Can I share the report?
Yes. Create a shareable artifact, save it to the Vault, and share it with people inside or outside X-Analytics.

Questions about the assessment? Reach out to your X-Analytics customer success team at

customersuccess@x-analytics.com.

Related

Account & access management policy assessment: score your policy in minutes
Score your account and access management policy against CIS Controls, update your profile, and see which improvements reduce the most risk.

Meet the CIS CSC 8.1 Upload agent
Upload your CIS Critical Security Controls v8.1 results and turn them into your X-Analytics profile.

The X-Analytics grids: now interactive and shareable
Sort, filter, and share your Cyber Risk, Control Effectiveness, and Threat grids by link.

Vault: save, annotate, and share your artifacts
Store the artifacts you create, add your own notes, and share them with access you control.

Questions about the assessment? Reach out to your X-Analytics customer success team at

customersuccess@x-analytics.com.

© 2026 X-Analytics. All rights reserved.