CYB_410_Risk_Register_Sam_Davidson.xlsx

	A	B	C	D	E	F	G	H	I	J	K	L
1	Green Thumb Risk Register
2	Positive Risk Response Options	Exploit	Share	Monitor	Accept	Probability/Impact	PI Score
3	Negative Risk Response Options	Avoid	Transfer	Mitigate	Accept	1	1-3	Low
4	Alternative Response Options	Contingency				2	4-6	Moderate
5						3	7-9	High
6						Note: Colors in the heat map are conditionally formatted for your use in the template. Do not modify.
7	Risk	Something that has not happened but might
8	Issue	Something that has already happened
9	No longer active
10	Risk ID	Description	Risk Trigger	Risk Category	Probability (1-3)	Impact (1-3)	PI Score	Expected Result, No Action	Risk Response Type	Response Trigger	Response Description	Expected Impact of Response
11		Description of the risk	How you know the risk is becoming an issue or has reached a point that requires action.	Group defines the types of risks (technological, financial, employee, etc.)	Group-sourced rough estimate of how likely this is to occur	Group-sourced rough estimate of how significant the impact of this risk will be if/when it becomes an issue	Probability multiplied by impact	What will happen if the risk becomes an issue and no action is taken	Decision made by group on how to respond to this risk (see above in blue)	How do you know it is time to put the response into play?	What is the response?	What do you expect will result from the response?
12	EXAMPLE	There is a chance that the project cost will exceed the amount that the company has budgeted for the work.	If the expected work remaining will cost more than $9,000 over budget, we will need to seek additional funding from management.	Financial	2	3	6	We will not be able to secure funding necessary to complete the project. Work may stop before MVP has been achieved. Product may never get to market and be deemed a total failure.	Mitigate	When estimated cost for MVP is within 5K of approved project total, we will begin seeking additional funding.	Meet with key stakeholders to review finished product, total spend to date, work remaining, and expected total spend. Ask for additional funding to complete work.	Given that our team has a mostly stable velocity and a proven ability to meet commitments and deliver value, we expect the answer to be yes provided the total amount of requests is less than $25K.
13	Ordering Supplies	There is a chance of not having access to the supplies necessary to support the nursery (including office supplies, fertilizer, additional inventory, and so on).	If the weekly inventory check runs into technical issues, and the staff is unable to order fertalizer. This becomes a critical issue after a day of downtime.	Technological	1	3	3	The team will not be able to order vital supplies as normal and either be forced to pay extra for goods, or experience a loss of plant inventory.	Monitor	When the ability to access inventory systems has become an issue for more than 6 hours.	Provide a site based technician to review current systems and network to check potential causes of loss of service and remediate the issue.	Given the highlighted product the nursery orders is fertalizer from Amazon, it is likely that any issues preventing access are to be network-based. For this reason an on site technician should be able to quick establish the root cause and resolve the issue.
14	Technology	There is a chance of not being able to access the the point-of-sale (POS) system or the licensing portal for regulated items (for example, pesticides and chemicals).	The initial notifier of an issue would be during the daily inventory checks if the POS system were to be inaccessible.	Technological	3	2	6	In the case of no action taken against a loss of the POS system the organization will be forced to handle all purchasing and client documentation via paper increasing risk to integrity and confidentiality.	Contingency	When the POS system has been inaccessible for more than a day.	Ensure redundancy is in place for the POS system in case of a primary system failure.	The response will give the nursery an acceptable backup solution to handling purchase and client information until their IT partners are able to repair the existing system.
15	Physical Security	There is a chance that if physical security is not in place, the opportunity for breaking and entering occurs.	An alert on the monitored security systems activating outside of operating hours.	Financial	1	3	4	No action taken against a physical security issue can result in theft of stock, customer information, and property damage.	Share	In the case of recurring alerts on the security system, or active theft situation.	Response to any critical security alert should be an automated alert to local law enforcement as well as the business owners, security feeds should be stored both locally and remotely (following the 3-2-1 backup practice) to ensure evidence is available for the authorities.	Improvements to the security response and storage systems will help mitigate risk by making the organization a more difficult target, and assist in any litigation in the case of a security issue.
16	Asset Management	There is a chance of loss of quality control or loss of crop due to environmental factors or growing techniques.	Stored records on the Grow and Care record system shows increased reports of 'terminated' inventory.	Financial	1	2	3	If no action is taken the potential for a loss of profits due to declining stock amount and/or quality standards may cause harm to the organization.	Transfer	If the POS system shows a trend in declining inventory quality and/or quantity.	The response in this situation is to transfer the responsibility to the organization as they are the subject matter experts regarding growth techniques and their environmental factors.	This risk is due to environmental and professional factors attributed to the industry itself, thus technical or security based support would be unable to assist in a meaningful manner.
17	Insurance	There is a chance of not having the proper insurance that would cover different situational issues related to business assets and employees.	If during the monthly safety report a discrepency is found in current coverage against OSHA standards.	Financial	1	2	2	In the case of insurance coverage, not correcting the coverage can cause heavy financial losses due to either fines or liability in the case of a person coming to harm.	Mitigate	If the current insurance coverage does not cover all potential incidents that have a decent chance of occuring on the job.	This situation requires the organization to ensure regular checks of their insurance coverage, as well as current OSHA guidelines and standards, as well as to update their plans accordingly.	While a potential added cost, I believe the mitigation of potential fines or liability charges will help ensure satisfaction of the nursery and its employees.
18	Safety	There is a chance there could be an opportunity for mortal danger because of the nature of the business (for example, using ladders, forklifts, and pesticides).	In the case that old or outdated equipment such as safety gear, ladders and forklifts are inspected and noted as potentially dangerous.	Employee	1	3	4	Were safety issues to not be resolved it may incur legal and financial reprecussions to the organization.	Avoid	It is time to put the response into play when equipment no longer meets safety requirements established by OSHA or other regulatory standards.	In the case of safety concerns, the response should be to regularly inspect, maintain, and update all relevant equipment regularly to ensure chances of harm are kept to a minimal risk.	The results of this response will be a consistant ability to rely on and trust organization equipment, and strong safety and security standards for all employees.
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100