TECHNOLOGY RISK ASSESSMENT BRIEF AND FINDING REGISTER
Yenra | https://yenra.com/technology-risk-consulting/
Use: define the brief before commissioning work. Duplicate the FINDING block for
each scenario. Record evidence locations; keep confidential evidence separately.
This is an original planning aid, not a certification or a universal risk scale.

BRIEF
Business owner / decision required / report date:
Business processes, systems, locations, suppliers and assessment period:
In-scope work / exclusions and resulting limitations:
Testing permissions and limits / urgent escalation contact:
Evidence access, confidentiality, retention and deletion arrangements:
Assessment method and rating definitions:
Deliverables, review meeting and acceptance criteria:

FINDING
ID / title / observed date:
Business activity and dependency:
Event or threat; observed condition or vulnerability:
Evidence reference / method / sample size / limitations:
Existing protections and evidence of their operation:
Business impact / likelihood basis / confidence / unknowns:
Priority and rationale (use defined categories; avoid false precision):
Decision: improve / investigate / avoid / transfer / accept, with rationale:
Action owner / due date / resources / dependencies:
Expected result and closure test:
Actual test date / result / evidence / residual limitations:
Acceptance approver, if applicable / review date / reassessment trigger:

FICTIONAL EXAMPLE
Order and warehouse applications share one identity service.
Observed: shared dependency and no recent recovery-test record.
Unknown: time required to restore usable access and reconcile interrupted work.
Action: operations defines its interruption objective; IT runs an authorized test.
Closure: record timing, account access, application errors and reconciliation.
Reassess if the service design or dispatch requirements change.
Source context: NIST SP 800-30 Rev. 1 is a federal assessment reference;
NIST SP 1300 addresses small-business cybersecurity. Tailor scope to your business.