What's new

Working a register

A register turns vague worry into a ranked, owned list, so attention and budget go where the exposure actually is. The score is never the goal; the decision it drives is.

• 1 · Write it as a risk, not a worry — if you cannot state a likelihood and an impact for it, it is not yet a register entry. Forcing both onto a scale is what makes two risks comparable, and comparison is the whole point.
• 2 · Score it inherent first — likelihood (1–5) × impact (1–5), before any treatment. The product lands in one of four bands — low (1–3), moderate (4–9), high (10–15), critical (16–25) — which is what colours the pills and the heatmap cells.
• 3 · Agree what a "3" means — a 5×5 only helps if the numbers mean the same thing to everyone rating against them. Write the level definitions down and rate against those, not against today's mood.
• 4 · Pick a response — Avoid, Reduce, Transfer or Accept, and put the treatment plan in the risk's own markdown pane rather than in a document nobody will open.
• 5 · Set the residual once controls land — this is the only honest way to show what the treatment bought you, and it is the number that should move between reviews.
• 6 · Read it from the heatmap — the 5×5 view is the one to put in front of people who will not read a list. Filter to High+ first; that is usually the whole conversation.
• 7 · Close the loop — every risk ends Open, Mitigated, Accepted, Transferred or Avoided. A register where everything is still Open is a list of worries again.

Mind the false precision

The matrix ranks and groups risks; it does not measure them. When a decision needs real numbers, move to loss frequency × loss magnitude estimated in ranges instead of pretending the grid is precise. The 5×5 lineage runs through NIST SP 800-30 Rev 1, ISO 31000 and COSO ERM; the quantitative path is FAIR — see Hubbard & Seiersen, How to Measure Anything in Cybersecurity Risk.

Where your risks live

PumaRisk stores everything in your browser's sessionStorage under the pumarisk.* prefix — on this device, in this browser, and nowhere else. There is no server, no account, and nothing you type ever leaves your machine.

Backing up

The topbar Export button writes a full backup of every workspace as .pumapack JSON. ⌘S / Ctrl+S writes the same full backup as a .json file. To restore, drag either file onto the window or use the topbar Import button.

Rule of thumb: export weekly. Drop the JSON in iCloud Drive, Dropbox, your Git repo — it's just a file.

Clear all local data

About PumaRisk

PumaRisk is a lightweight, portable, offline quantitative risk register that runs entirely in your browser. Build a register, score and rank risks, and model treatment options, all from a single file.

This tool is provided as-is, with no warranties or guarantees. It is not professional advice. By using it you accept full responsibility for any outcomes that result from your use.

About PumaWorx

PumaWorx is a suite of offline, single-HTML productivity apps that run entirely in your local browser. The entire suite is a personal, open source vibecoding project.