How Do You Build a Client Risk Register With Custom Risks? | Office Hours

Every new client starts with a risk register populated with 39 system-generated strategic risks grounded in the Secure Controls Framework (SCF) risk management methodology. You can now add custom risks at the tactical, operational, or strategic level, fork a built-in risk to tailor it to one client, or bulk upload the client's existing register. Risks link to tasks, so residual risk reflects the work actually completed, and the Risk Coworker suggests recalibrated scores for you to review and apply. Learn more about risk management in Cynomi: https://cynomi.com/platform/risk-mana... How Do I Add a Risk That Isn't in the Built-In Register? Open the risk register and create a custom risk with a name, description, category, NIST function, and CIA triad impact. Inherent risk is calculated as impact times likelihood, and you can flag it as a key risk. Choose one of the 39 system risks as a starting point to get suggested tasks to link, and write a detailed description, because the platform reads it to decide which tasks are relevant. To adjust an existing risk instead, use copy and customize to create an editable copy and disable the original. Why Are There No Suggested Tasks for My Risk? Tasks are only suggested if they exist in the client's scope. If you scoped a client tightly to one framework, such as the HIPAA Security Rule with no privacy tasks, a privacy risk has nothing to link to. Since tasks are now generated when the scope is defined rather than after the assessment, you can build the register before, during, or after the assessment. Why Doesn't Residual Risk Drop When Tasks Are Closed? Residual risk is a field you set after discussing compensating controls with the client, and the Risk Coworker can help recalibrate it. Only linked tasks inform it; suggested tasks are ignored until you link them. Closing every task lowers a risk but never removes it, so it stays on the register at a lower rating. How Do I Document a Client Accepting a Risk? Set the treatment plan to accept, avoid, mitigate, or transfer. Accepting a risk opens a formal acceptance flow with an acceptance period, a calculated review date, and a justification, and it records the logged-in user as the signer. If the decision is the client's, note it in the justification or invite them into the platform to sign off. Next review dates and an overdue filter let you track what needs revisiting. Can I Bring In a Risk Register the Client Already Has? Yes. Bulk upload it using the template, with name, description, category, and inherent impact and likelihood as required fields, then deactivate any of the 39 built-in risks you do not need. Once risks are linked to tasks, you can show a client in a QBR how the work you delivered moved each risk to a lower rating. How Does the Risk Coworker Recalibrate Residual Risk? Flag key risks first, then ask the Risk Coworker to recalibrate residual scores. It asks whether controls are tested, what has changed since the last scoring, and whether anything is managed outside the platform. It then returns an executive summary and a suggested rating for each risk, with its reasoning. Nothing changes until you choose which suggestions to apply, and every change is recorded in the risk's audit log. Who This Is For Service providers delivering risk management as a standalone service or as part of a vCISO offering: MSPs, MSSPs, IT service providers, and consultancies. It assumes you already work in client tenants in Cynomi. Speakers Jack Thompson, Field CISO and Solutions Engineer, Cynomi Patrick Costello, Manager, Partner Account Management, Cynomi Chapters 00:00 - Welcome, agenda, and housekeeping 05:48 - What methodology is the risk register built on? 08:38 - How do you add a custom risk? 13:47 - How do you customize a built-in risk? 15:57 - Why are no tasks suggested for a risk? 17:59 - When should risk enter a client engagement? 20:38 - Does residual risk update when tasks close? 23:45 - Who owns and is responsible for a risk? 25:01 - How do you document a client's risk acceptance? 27:52 - How do you track reviews and inactive risks? 30:14 - Can you import a client's existing risk register? 31:36 - How do you show risk reduction in a QBR? 32:22 - How does the Risk Coworker recalibrate residual risk? 37:19 - Can risks link directly to assets? 38:49 - How do you review and apply suggested scores? 42:54 - Who can access the AI Coworkers? 44:03 - Feature requests and what's next Learn more about Cynomi: https://cynomi.com/ About Cynomi Cynomi is the agentic Security Growth Platform for service providers, powered by CISO Intelligence, with the decision-making logic of an experienced security leader embedded into every workflow. Purpose built for MSPs, MSSPs and consultancies, Cynomi helps service providers deliver, scale, and grow cybersecurity services across every client and every maturity level. Partner with us at www.cynomi.com.