> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/msi/review-your-threat-model/triage-risks-in-the-risk-register.md).

# Triage risks in the Risk Register

The Risk Register is the living, reviewable record of your device's threats. Each row is a risk from your threat model with its score, affected assets, controls, and review state. Work through the rows to approve, retire, or flag each one, close control gaps, and sign off the register before you export it.

## Before you begin

* Your organization's plan must include Threat Modeling.
* Run a threat model for the selected device version. See [Review your threat model](/msi/review-your-threat-model.md). Until one exists, the Risk Register shows the threat model start form instead.

## Open the register

1. In the sidebar, select **Risk Register**. You can also select **View Risk Register** on the **Threat Model** page.
2. Check the counts summary at the top for how many risks are reviewed, unreviewed, or missing a control.

The register has three tabs: **Risks**, **Controls**, and **Security Use Cases**.

## Find the risks that need attention

On the **Risks** tab, narrow the list with the filters. Filters combine, so you can ask for, say, unreviewed risks with no control.

| Filter              | Options                                                                                                                                        |
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| **Status**          | **Unreviewed**, **Needs re-review**, **Orphaned**, **Reviewed**, **Flagged**                                                                   |
| **Risk**            | The risk bands from your scoring formula, plus unscored risks                                                                                  |
| **Controls**        | **Controlled**, **Suggested control**, **No control**                                                                                          |
| **Evidence**        | **Live CVE (SBOM)**, **Pen test (demonstrated)**, **Scanner / code review**, **No evidence**. Appears when any risk has this kind of evidence. |
| **Re-review cause** | Why a risk was sent back for review, such as **Evidence changed** or **Scoring formula changed**. Appears when any risk needs re-review.       |

You can also:

* Search with **Search risks...** by ID, title, description, or asset name.
* Change how rows are grouped: **Risk** (a flat list), **Element Type**, **Device Asset**, **Interface**, or **Risk Group**.
* Reorder with **Sort by**: **Risk (attention-first)**, **Asset**, **Threat actor**, **STRIDE category**, or **Risk ID**.

**Suggested control** means the only controls on the risk are AI suggestions that aren't backed by your documents yet. A risk with a suggested control isn't mitigated until you accept or document a control.

## Review a risk

1. Select a row to open its details.
2. Work through the tabs:
   * **Overview**: the description, attack vector, affected assets, threat actor, CWE mapping, and evidence claims.
   * **Risk**: the **Pre-control** and **Post-control** scores factor by factor, with the **AI rationale** for each. Adjust a factor if you disagree and record why in **Review Notes**.
   * **Controls**: the controls mapped to this risk. Select **Accept suggestion** on a suggested control or **Add control** to add your own.
   * **Risk story**: a diagram of how the attack unfolds.
   * **Vulnerabilities**: CVEs from your SBOM linked to this risk. Appears when the risk has SBOM evidence.
   * **History**: every change to the risk.
3. Decide:
   * **Approve row** when the risk, score, and controls are right.
   * **Retire** when the risk doesn't apply. You must give a reason, which stays on the record for reviewers and auditors.
   * **Flag** to leave a note for the next person without changing the review state.

You can also assign a risk to a teammate from the details panel.

## Review risks in bulk

1. Select the checkboxes on the rows you want, or select **Select N suggested approvals** to pick the risks the system recommends approving.
2. In the action bar at the bottom of the screen, choose **Approve**, **Unapprove**, **Retire**, **Group selected**, or **Regenerate scores**.

If one row in a bulk action fails, the others still go through and the failures are listed for you.

## Manage controls

The **Controls** tab lists every control across the register, grouped as **Established controls**, **Suggested controls**, **Retired controls**, and **Rejected controls**. Use it to review suggested controls in one place and see which risks each control covers. Search with **Search controls or the risks they cover...**.

## Sign off and export

1. When you've worked through the register, select **Mark review complete**. This records that you've reviewed the register. The sign-off is cleared automatically if the register changes afterward.
2. Select **Download risk analysis** and choose **Excel (XLSX)** or **PDF**.

{% hint style="warning" %}
You can always download the register, but a register that isn't signed off is labeled. Until someone selects **Mark review complete**, the file opens with a **DRAFT — not reviewed** notice. If blocking items are still unresolved, it carries an **ALPHA — work in progress** watermark that lists them. Either way, the file is marked not for regulatory submission.
{% endhint %}

## Next steps

* [Compare your threat model with pentest or scanner findings](/msi/review-your-threat-model/compare-with-pentest-or-scanner-findings.md): attach real test evidence to your risks.
* [Assign work and track My Work](/msi/assign-work-and-track-my-work.md): hand risks to teammates and follow up.
* [Generate submission documents](/msi/check-estar-readiness/generate-submission-documents.md): turn the reviewed register into submission material.