# SAMPLE: Risk register (extract)

> This is a sample document published by ISMS Copilot (ismscopilot.com/mcp) for trying the example prompts. Example Co is fictional. It is written with inconsistencies on purpose: compare it with the sample Statement of Applicability extract.

**Company:** Example Co (fictional) | **Version:** 2026-Q3

| ID | Risk | Likelihood | Impact | Treatment | Controls | Treatment status | Owner |
|---|---|---|---|---|---|---|---|
| R-01 | Loss of customer data after a database failure or deletion | Medium | High | Reduce | 8.13 Information backup | Planned: daily snapshots and quarterly restore test | Head of Engineering |
| R-02 | Supplier breach exposes customer data | Medium | High | Reduce | 5.19, 5.21 | In progress: supplier questionnaire drafted | COO |
| R-03 | Misconfigured cloud storage made public | Medium | High | Reduce | 5.23 Cloud services | Planned: configuration baseline and monitoring | Head of Engineering |
| R-04 | Ransomware on a staff laptop | Low | High | Reduce | 8.7 Malware | Implemented | Head of Engineering |
| R-05 | Long outage of the main cloud region | Low | High | Accept | None | Accepted by CEO | CEO |
| R-06 | Undetected misuse of an admin account | Medium | High | Reduce | 8.15 Logging, 8.16 Monitoring | Planned | Head of Engineering |