Final Project: Build a Mini Risk Register and Control Mapping

Bring governance, risk, and compliance together the way you would on a real team: pick a small, realistic system (a side project, a fictional startup, or a system you already know well) and build a mini GRC artifact set for it.

Requirements

1. Describe the system: two or three sentences on what it does and what data it handles (e.g. "a to-do list app that stores user emails and task text in a hosted Postgres database").
2. Risk register: identify at least 5 realistic risks. For each, include a likelihood (Low/Medium/High), an impact (Low/Medium/High), an owner (a role, e.g. "Backend Lead"), and a chosen treatment (Avoid/Mitigate/Transfer/Accept) with a one-sentence justification.
3. Control mapping: for each risk you chose to Mitigate, name one specific, concrete control that addresses it (not "add security", something a control could actually check, like "enforce MFA for all admin accounts" or "encrypt the database at rest with AES-256").
4. Evidence plan: for two of your controls, describe what evidence would prove to an auditor that the control is actually working (a log, a config export, a signed-off review), not just that it exists on paper.
5. One accepted risk: pick exactly one risk you deliberately choose to Accept rather than treat, and write the documented justification a real risk acceptance would need (why, who signed off, and when it should be reviewed again).

Stretch goals

• Map two or three of your controls to a real framework's language (e.g. "this satisfies SOC 2's Security criterion" or "this supports GDPR's breach notification requirement").
• Add a simple RACI table for who is Responsible, Accountable, Consulted, and Informed for your incident response process.
• Write a one-paragraph policy statement (the "what and why") that one of your controls exists to enforce.

Submit your risk register and control mapping (a document, spreadsheet, or markdown file, a repo link or gist is fine) below, an instructor will review it before you can mark this lesson complete.