ChelseaBoi82

Please ignore my bad example... it was a good example of losing train of thought through interruption, but it’s not an example of how we mitigate the risk of USBs at all I really appreciate the advice and it gives me something to think about. Obviously it's a given that risks are thought of and taken into account when setting things up here, and I do make notes of what potential risks could be associated with various things, just not in 1 place and not to that level of detail so it looks like I have got a bit of work to be getting on with.

Hi all, First time posing but long-time visitor to the site. I just have a quick question in regards to the Cybersecurity risk register that we should be keeping as a school… I do have a register template, however when I set it up I was under the impression that it needed to be filled in AFTER something had been discovered, for example Jane Doe lost her school iPad and now we have to mitigate the risk going forward, report it to Govs, etc. However, I am now wondering whether that is correct, or whether it needs to be filled in with any risks that COULD happen along with the rational on how we mitigate to prevent it happening. For example, John Doe could attach an infected USB device to the network and spread a virus across the school, so we use encrypted USBs only to minimise the risk. Basically, how do you guys currently carry out this process? Obviously, I am hoping I was right in that it is a risk register for issues that are discovered or could potentially cause an issue… rather than a register of absolutely every risk there could be. Advice is much appreciated Steve