A free SOC 2 risk register template with real rows
A blank grid teaches nothing, so this one comes with six rows already written. Download the workbook, replace the rows, keep it current.
Here is a SOC 2 risk register template you can copy for free, with the rows already filled in. Every risk sits on one line with a score, one owner, a decision, and the control that deals with it. Swap our six sample rows for your own and you have a working register.
The workbook adds a scoring sheet and a score that works itself out. The risk assessment policy is the method this register follows.
Why SOC 2 wants this table
The 2017 Trust Services Criteria carry the COSO framework into the common criteria, and a block of them is about risk.1 CC3.1 wants objectives clear enough to attach risks to. CC3.2 wants risks identified and analyzed as the basis for deciding how to manage them. CC3.3 asks you to think about fraud on purpose. CC3.4 wants significant changes reassessed, and CC9.1 covers planning for business disruption.
Read CC3.2 twice. It is about decisions. A register with scores but no treatment column does not meet it.
The columns
Ten columns carry the load. The owner and the control link matter most, because those two turn a list of worries into something someone does and something an auditor can check.
| Column | Contents | Why keep it |
|---|---|---|
| ID | R-01 and up, never recycled | Controls and evidence point back to it |
| Risk | One sentence: what could happen, to what | “Access” is a topic, not a risk |
| Category | Access, change, vendor, people, fraud, continuity | Shows you which area has no rows |
| Owner | A single person | A team owner means nobody acts |
| L and I | Likelihood and impact, one to five each | Kept apart so people can argue each one |
| Score | L times I | Sets the order of work |
| Treatment | Mitigate, transfer, avoid or accept | The decision CC3.2 asks for |
| Control and evidence | Your control ID and where its proof lives | Makes the row testable |
| Residual score | Score after treatment | Shows the work changed something |
| Dates | Found, last reviewed, next review | Proves the register is alive |
Six sample rows for a small SaaS team
These are written for a twelve person company on AWS. They are concrete on purpose, because “unauthorized access” as a row tells you nothing about what to fix. L is likelihood and I is impact.
| ID | Risk | Owner | L | I | Score | Treatment | Control | Evidence |
|---|---|---|---|---|---|---|---|---|
| R-01 | An engineer leaves and keeps AWS and GitHub access, because offboarding is a Slack message | CTO | 3 | 5 | 15 | Mitigate | AC-04 | Offboarding checklist, access review export |
| R-02 | Long lived AWS access keys sit on laptops and never rotate | Platform lead | 3 | 4 | 12 | Mitigate | AC-07 | Monthly IAM credential report, keys over ninety days |
| R-03 | All four engineers approve and merge their own pull requests | CTO | 4 | 3 | 12 | Mitigate | CM-02 | Branch protection export, sample of merged requests |
| R-04 | The production database snapshots nightly and nobody has restored one | Platform lead | 2 | 5 | 10 | Mitigate | BC-01 | Quarterly restore test record, with duration |
| R-05 | One admin role issues refunds and edits the billing record behind them | CEO | 2 | 4 | 8 | Mitigate | FR-01 | Monthly refund report, signed and dated |
| R-06 | The transactional email vendor holds customer addresses and has no SOC 2 report | Head of operations | 3 | 3 | 9 | Accept. Accepted by the CEO, review at renewal | VM-03 | Acceptance memo, vendor register entry |
R-05 is the fraud row CC3.3 asks you to think about. R-04 still belongs here under a Security only scope, since recovering from a security event is part of the common criteria, though how deeply it is tested depends on scope. The scoping tool helps with that choice.
A scale anyone can reuse
One to five for likelihood, one to five for impact, multiply. A three point scale is just as valid. What matters is a written meaning for each number, so the same four means the same thing in January and in June. Skip weighted asset models and loss formulas. At twelve people they produce numbers nobody can explain six months later, and the time is better spent fixing R-01.
Four ways to treat a risk
Every row ends in one of four decisions. “Still looking into it” is not one of them, and a row left there has no treatment.
- Mitigate
- Add or tighten a control and point the row at it. Five of the six rows above.
- Transfer
- Shift the cost to someone else through insurance or a contract. The event can still happen.
- Avoid
- Stop the activity: drop the vendor, the feature or the data you did not need.
- Accept
- Carry the risk knowingly. This is the only treatment that needs a signature from someone with authority, a date, and a date to look again. The person who found the risk does not sign. On a small team that is a founder or officer, as SOC 2 for a small team explains. R-06 is an example: a vendor with no report, accepted by the CEO until renewal. The vendor management policy says what to collect from a vendor like that instead.
When to review it
Yearly at minimum, quarterly if you ship often. Under CC3.4, a big change triggers a review whatever the calendar says: a new critical vendor, a first enterprise deal, an incident, a new region.1 For a Type 2, check the dates. A review finished before your window opened is a good habit but not evidence for that window.2 The shortest window is a 3-month observation window, so plan at least one review inside it.
Link every row to proof
Test your register with one walk. Pick a row, open the control it names, then open the evidence that control produced. If any step fails, the row is a claim, not a control. Use your own control IDs, not criterion numbers: CC6.2 is a criterion, AC-04 is something you run. Most of that evidence also appears on the PBC list, and the matching documents are in the SOC 2 policy list.
What a risk review costs if you buy one
Filling in this template yourself costs a few hours. Firms that sell professional readiness work publish figures like these for an assessment:
- Secureframe states that a professional SOC 2 readiness assessment typically costs between $10-17,000, and that cost depends on the size of your organization and the scope of your audit. Source, checked 2026-10-02.
- IS Partners, an audit and advisory firm, states that a professional SOC 2 readiness assessment can cost anywhere between $10,000 to $17,000, and that the assessment itself can take anywhere from a few weeks to a few months. Source, checked 2026-10-02.
The cybersoftware free readiness assessment costs nothing and takes about 15 minutes. It gives you your readiness score, every gap category counted with exact numbers, and your first findings written out in full. Start it here. If you want the register kept for you, with every row tied to the evidence behind it, onboarding is $2,000 one time. A SOC 2 Type 1 is $4,000 one time instead, with the first examination and the independent partner auditor fee included. All prices are on pricing.
cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.
Questions
What is a risk register in SOC 2?
Which columns should the register have?
How should risks be scored?
Is it acceptable to accept a risk rather than fix it?
How often must the register be reviewed?
Sources
Get audit-ready without a compliance team
The readiness assessment is free, with no payment and no card. Onboarding is $2,000 one time, then SOC 2 Type 2 is $600 a month on a 12-month term, and your first SOC 2 Type 2 audit is included in the term. You can be audit-ready starting at about a week.
Start with a free readiness assessmentcybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.