Cyber security has become one of the most material risk categories facing Australian businesses. In 2023–24, the Australian Signals Directorate (ASD) received over 87,400 cybercrime reports — a 23% increase on the previous year. The average cost of a cybercrime to a small business was over $49,000, rising to $97,200 for medium businesses. And these figures only count incidents that were reported.

Behind every successful cyber attack on a business is, almost always, a risk that was known or knowable — a vulnerability that wasn’t patched, a control that wasn’t implemented, a threat that wasn’t assessed. A cyber security risk register doesn’t prevent cyber threats from existing. What it does is ensure your business has a structured, documented, and regularly reviewed process for identifying what those threats are, assessing how serious they could be, and maintaining the controls needed to reduce your exposure.

This guide explains what belongs in a cyber security risk register, how to align it with the Australian Cyber Security Centre (ACSC) Essential Eight framework, and how to make it work as a live governance tool rather than a point-in-time document.

What Is a Cyber Security Risk Register?

A cyber security risk register — sometimes called a cyber risk register or IT security risk register — is a specialised form of risk register focused on information technology and information security risks. It documents all identified cyber threats to your business, assesses their likelihood and potential impact, records the controls in place to mitigate them, assigns ownership, and tracks outstanding treatment actions.

The structure mirrors a standard risk register: each risk has a description, likelihood and consequence ratings, a combined risk level, current controls, residual risk after controls, a named owner, treatment actions with due dates, and a review date. A cyber security risk register is not the same as a vulnerability scan or a penetration test report, though both feed into it. Those tools identify specific technical vulnerabilities. The risk register captures the broader risk picture — including threats that aren’t technical in nature, such as insider risks, social engineering, and third-party vendor exposure.

The Australian Cyber Threat Landscape

Understanding the current threat environment is the starting point for any cyber risk register. The ACSC’s Annual Cyber Threat Report consistently identifies the following as the highest-frequency, highest-impact threats for Australian businesses.

Ransomware remains the most destructive cyber threat facing Australian organisations. Ransomware attacks encrypt business data and systems, rendering them inaccessible, and typically demand payment for restoration. Average downtime from a ransomware attack is measured in days; the total cost — including recovery, lost revenue, and reputational damage — can be existential for smaller businesses.

Business Email Compromise (BEC) is the highest-volume cybercrime category in Australia by financial loss. BEC involves the compromise or impersonation of a legitimate business email account to redirect payments, harvest credentials, or access sensitive information. It is overwhelmingly a social engineering attack — technology alone doesn’t stop it.

Phishing and credential theft underpin the majority of successful cyber intrusions. Attackers use phishing emails, SMS messages, and fake login pages to harvest credentials for unauthorised access to business systems, email accounts, and cloud services.

Data breaches and unauthorised access cover incidents in which customer, employee, or business data is accessed, exfiltrated, or exposed. Notifiable data breaches under the Privacy Act 1988 — which applies to businesses with annual turnover above $3 million and certain other categories — must be reported to the OAIC and affected individuals.

Supply chain and third-party risk is an emerging priority. As businesses rely more heavily on cloud services, SaaS platforms, and external IT providers, the cyber risks posed by third parties with access to your systems and data have grown significantly.

Aligning Your Cyber Risk Register with the ACSC Essential Eight

The Australian Cyber Security Centre’s Essential Eight is the most widely adopted cyber security baseline framework for Australian organisations. It consists of eight mitigation strategies — organised across three maturity levels — that the ACSC considers most effective at preventing and limiting the impact of cyber attacks. Aligning your cyber risk register with the Essential Eight provides a structured way to ensure your controls address the most critical threat vectors.

Application control prevents execution of unapproved or malicious programs. Patch applications and operating systems ensures security vulnerabilities are addressed within defined timeframes — 48 hours for critical vulnerabilities at Maturity Level 3, 14 days at Level 2. Configure Microsoft Office macro settings blocks macro-based malware delivery. User application hardening reduces browser and application attack surface.

Restrict administrative privileges limits the damage an attacker can do after initial compromise. Multi-factor authentication is among the single most effective controls for preventing credential-based attacks — at Level 3, phishing-resistant MFA is required for all users. Regular backups — stored offline and tested for restoration — are the primary defence against ransomware’s most damaging consequence: permanent data loss.

Each of these eight areas should have one or more entries in your cyber security risk register. The register should record the current maturity level for each Essential Eight control, any gaps relative to your target maturity, the risk exposure created by those gaps, the treatment actions required to close them, and the owner responsible.

Building Your Cyber Security Risk Register: Key Risk Categories

Network and infrastructure risks include unauthorised network access, unprotected perimeters, insecure remote access configurations, and legacy systems that can no longer be patched. For businesses with hybrid or remote work arrangements, the attack surface has expanded significantly.

Data and privacy risks cover the protection of sensitive data — customer PII, financial records, intellectual property, employee data — against unauthorised access, exfiltration, or exposure. For businesses subject to the Privacy Act, notifiable data breach obligations make this category especially consequential.

Identity and access management risks address credential compromise, weak authentication, excessive user privileges, and inadequate management of joiners, movers, and leavers. Credential-based attacks are the most common initial access vector in Australian cyber incidents.

Third-party and supply chain risks capture the exposure created by vendors, cloud providers, managed service providers, and other third parties with access to your systems or data. A cyber risk register should include a section on vendor risk — particularly for high-criticality suppliers with privileged access.

Human factors and social engineering risks cover phishing, BEC, insider threats, and the risks created by user behaviour. Technical controls alone cannot address these risks; training, awareness programs, and strong processes — such as payment verification procedures — are essential controls.

Who Should Own Cyber Security Risks?

Technology-specific risks (unpatched systems, network vulnerabilities, backup failures) naturally sit with the IT Manager, CTO, or an equivalent technical owner. But cyber security risk is not purely a technical problem. Business Email Compromise risk is partly owned by Finance (which controls payment processes) and partly by HR (which manages identity for departing staff). Data privacy risk may be owned by the Privacy Officer or General Counsel. Third-party risk may be owned by Procurement.

The cyber risk register should reflect this — with technical risks owned by IT, and business-process cyber risks owned by the appropriate business leader. The CISO or IT Manager is typically responsible for maintaining the register and coordinating the review cycle. Senior leadership and, for significant organisations, the board risk committee should receive regular reporting on the overall cyber risk profile.

Frequently Asked Questions

Does every Australian business need a cyber security risk register?

Not every business is legally required to maintain one, but any business that uses IT systems to store, process, or transmit sensitive data — which describes almost every business of meaningful scale — should have a documented cyber risk management process. Businesses subject to the Privacy Act 1988 have obligations around reasonable security measures for personal information. Government contractors are increasingly required to demonstrate Essential Eight compliance. The practical question isn’t whether you need one; it’s how formal it needs to be given your size and risk profile.

What is the ACSC Essential Eight and does it apply to my business?

The ACSC Essential Eight is a set of eight cyber security mitigation strategies published by the Australian Cyber Security Centre as a baseline for Australian organisations. It applies directly to non-corporate Commonwealth entities and is increasingly referenced in procurement requirements and insurance assessments for private sector businesses. For most Australian SMEs, targeting Essential Eight Maturity Level 1 is a practical starting point; larger or more exposed organisations should target Level 2 or 3. The Essential Eight is not legislation — but aligning your cyber risk register with it is widely considered best practice.

How often should a cyber security risk register be reviewed?

Cyber risks change faster than most other risk categories — new vulnerabilities are published daily. High and critical cyber risks should be reviewed at least quarterly. The full cyber risk register should be reviewed annually, or following any significant incident, major system change, or substantial change to your IT environment. A new cloud service, a major software deployment, or a change in remote work arrangements should each trigger a targeted review.

What’s the difference between a cyber risk register and a vulnerability register?

A vulnerability register is a technical log of known security weaknesses in your IT environment — typically generated by vulnerability scanning tools and managed by IT. It is granular and can contain hundreds of items. A cyber risk register operates at a higher level: it captures business-level cyber risks (ransomware, BEC, data breach, insider threat) with risk ratings, business impact assessments, and treatment plans. Vulnerability data feeds into the risk register — a critical unpatched vulnerability increases the likelihood rating for relevant risks — but the two serve different purposes.

Manage Cyber Risks with Lahebo

Cyber security risk doesn’t sit in isolation — it intersects with your compliance obligations (Privacy Act, Essential Eight, sector-specific requirements), your operational risk program, and your board governance framework. Managing cyber risk in a separate spreadsheet, disconnected from your broader risk register, creates exactly the siloed, incomplete view that allows material threats to fall through the gaps.

Lahebo’s risk register module supports cyber security risk alongside all other risk categories — with consistent risk ratings, named owners, treatment action tracking, automated review reminders, and direct links to Australian legislative and regulatory obligations. Your cyber risks live in the same system as your WHS, financial, and compliance risks, giving the board and executive team a complete, integrated picture.

For a broader overview of IT and technology risk management, see our related guide: IT Risk Register: A Complete Guide for Technology Risk Management.

For a comprehensive introduction to risk registers across all categories, see: What Is a Risk Register? The Complete Guide for Australian Businesses.

Manage your cyber security risks with Lahebo — book a demo today.