DevSecOps Practice Hub

Risk Management

Record, prioritise and periodically review security risks with named owners and decisions.

IntermediateRisk ManagementGovernance

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Plan Threat modeling, requirements and security design decisions.
  • Monitor Detection engineering, SIEM, compliance evidence and incident response.

Overview

A risk register captures identified risks with likelihood, impact, owner and treatment decision, and is reviewed on a cadence rather than left to rot.

Why it matters

Not every risk can be fixed. Explicit acceptance with an owner and a review date is better than silent acceptance.

How it works

  1. 01Risks are identified from threat models, incidents and scans.
  2. 02Each is scored and assigned a treatment: mitigate, transfer, accept, avoid.
  3. 03Accepted risks carry an owner and an expiry for re-review.

Common tools

DefectDojoJiraGitHubGitLab

Implementation examples

yamlRisk register entry
- id: RISK-2026-014  title: Legacy service uses static database credentials  likelihood: medium  impact: high  treatment: mitigate  owner: payments-team  action: migrate to Vault dynamic credentials  review_by: 2026-06-30

Best practices

  • Re-review accepted risks on a fixed cadence.
  • Tie risks to concrete remediation work.

Common mistakes

  • Accepting a risk with no owner or expiry.