Risk overview

Where the register sits before and after treatment, against tenant bands and appetite.

Appetite boundary (score > 9)

Low1–4Medium5–9High10–15Critical16–25

Inherent risk

Before controls · avg 11.1

Likelihood · 1 Rare → 5 Almost certain

5432112345

Impact · 1 Negligible → 5 Severe

After current treatment · avg 6.6

Likelihood · 1 Rare → 5 Almost certain

5432112345

Impact · 1 Negligible → 5 Severe

RSK-039Overdue

Privileged admin accounts lack MFA on local console access

16Critical16Critical

Mitigate · no movement yet

Outside ≤ 8

Cyber appetite: Minimal · tolerance ≤ 8

No tolerance for loss of CUI; accept minor availability risk on non-CUI systems.

Residual 16 exceeds tolerance — acceptance needs Dana Whitfield or further treatment.

Inherent L4 × I43 risks

2 of 18 outside appetite after treatment

ID	Risk	Category	Inherent	Treatment	Residual	Δ	Appetite	Owner
RSK-042	Ransomware encrypts engineering file shares containing CUI	Cyber	20	Mitigate	8	-12	Within ≤ 8	DWDana Whitfield
RSK-041	Sole-source machining vendor fails delivery for F-35 bracket	Supply chain	15	Transfer	9	-6	Within ≤ 12	ESElena Sorokin
RSK-039	Privileged admin accounts lack MFA on local console access	Cyber	16	Mitigate	16	—	Outside ≤ 8	TOTom Okafor
RSK-037	Calibration records for CMM machines incomplete	Quality	9	Mitigate	3	-6	Within ≤ 8	PNPriya Natarajan
RSK-035	Departing engineers retain access to CUI enclave	People	12	Mitigate	4	-8	Within ≤ 9	SASofia Alvarez
RSK-033	Cloud email tenant misconfiguration exposes FCI	Cyber	8	Mitigate	4	-4	Within ≤ 8	TOTom Okafor

Showing 6 of 18 · switch to Table for all

Pattern: Vanta 7ef755c6 side-by-side heat maps; TheyDo 58a50369 Table ↔ Matrix; Vanta a5332e5f Inherent | Treatment | Residual.

Risk