A live risk register, with exceptions that don't just quietly expire.
Every risk register has the same failure mode: an exception gets granted to close an audit finding, the expiry date passes unnoticed, and the "temporary" acceptance becomes permanent by neglect. The register says the risk is managed. Reality disagrees.
TruSecure keeps a live risk register linked directly to controls, with a structured exception workflow that enforces expiry and mandatory re-review. Risks are logged manually or AI-flagged from detected drift; exceptions are approved by a named person with a defined expiry — and expiry forces a decision.
How it works
- Log
Risks enter the register manually, or are flagged by AI when connected systems drift from the control model — a stale patch baseline, an unreviewed access list.
- Assess
Each risk is scored and linked to the controls it weakens, so its blast radius is visible in the same model the frameworks read.
- Except — with an expiry
Accepting a risk is a formal act: a named approver, a written rationale, and a defined expiry date. No expiry, no exception.
- Re-review
When the expiry approaches, the exception resurfaces for a decision — remediate, renew with a new date, or escalate. Nothing lapses silently; every outcome is on the record.
What an exception record looks like
{
"risk": "RSK-2026-0118",
"linked": "AC-2 · Account management",
"score": "moderate · stable",
"exception": {
"status": "approved",
"approver": "named risk owner",
"expires": "2026-10-31",
"re-review": "scheduled 2026-10-17"
}
}Which regulations it maps to
A risk process that cannot show its exceptions is not a risk process, as far as the regulator is concerned:
| Framework | What it expects | Citation |
|---|---|---|
| NIS2 | Risk-management measures, operated and documented | Art. 21(2) |
| DORA | A maintained ICT risk-management framework | Art. 6 |
| ISO 27001 | A defined risk assessment and treatment process | Clause 6.1 |
Where the drift signals come from
Vulnerability management and EDR/XDR connectors feed the drift detection — scan results, coverage status, remediation slippage — so risks surface from operational reality rather than from the next quarterly review.