URL: /partner/risk-register/
Maintain a DSPT-compliant risk register covering data and cyber security risks. Risks are scored automatically based on severity and likelihood.
Each risk is scored using two factors:
| Factor | Scale | Description |
|---|---|---|
| Severity | 1–4 | Impact if the risk materialises (1 = Minor, 4 = Critical) |
| Likelihood | 1–5 | Probability of occurrence (1 = Rare, 5 = Almost Certain) |
Risk Score = Severity × Likelihood (auto-calculated, range 1–20)
| Score | Level | Colour |
|---|---|---|
| 16–20 | Critical | Red |
| 8–15 | High | Orange |
| 4–7 | Medium | Yellow |
| 1–3 | Low | Green |
| Category | Examples |
|---|---|
| Data Breach | Unauthorised access, data loss, misaddressed information |
| Cyber Attack | Ransomware, phishing, malware, denial of service |
| Insider Threat | Malicious or negligent staff actions |
| Physical Security | Theft, fire, flood, unauthorised premises access |
| Third-Party | Supplier failure, data processor breach |
| Compliance | Regulatory non-compliance, missed deadlines |
| Operational | System outages, staff shortages |
| Reputational | Negative publicity, loss of patient trust |
The DSPT requires practices to identify and document their top 3 data and cyber security risks. Use the Is Top 3 checkbox to flag these. They will appear at the top of your risk list and on the CQC Compliance Dashboard.