Risk register and control status report
None of the held texts sets a fixed period on this consumer; every row below reads no period set by the text. Paste one job that feeds this consumer, for example risk_register_export, weekly, and the register reads its period against the clocks below, names the gap in hours, and carries the question for its owner.
Matched on the job name or the consumer column by these words: risk register, control status, risk report, control report, issue register, risk register report.
The clock each rule sets
| Regime | Clock | Clause |
|---|---|---|
| CPS 234 | no clock | CPS 234 para 28 Escalation of Unremediated Testing Deficiencies |
| SP 800-53 | no clock | SP 800-53 CA-7 Continuous monitoringa defined frequency |
Questions this page answers
How often does APRA CPS 234 require risk register and control status report?
The held text of CPS 234 para 28 (Escalation of Unremediated Testing Deficiencies) sets no fixed period: no period set by the text. Testing results that identify control deficiencies which cannot be remediated in a timely way must be escalated and reported to the Board or senior management.
How often does NIST SP 800-53 Rev 5 require risk register and control status report?
The held text of SP 800-53 CA-7 (Continuous monitoring) sets no fixed period: a defined frequency. Requires a system-level continuous monitoring strategy aligned to the organizational one, defining the metrics monitored, the frequencies for monitoring and for assessing control effectiveness, ongoing control assessment, correlation and analysis of the results, response actions, and reporting of security and privacy posture to defined personnel.
What does the register ask the owner of a risk register and control status report job?
Which open items in the register are past the date their owner set, and who sees that?
The clauses in full
Testing results that identify control deficiencies which cannot be remediated in a timely way must be escalated and reported to the Board or senior management.
What an assessor asks to see: Escalation records for unremediated deficiencies; Board or senior management reporting packs; Remediation tracker with timeliness assessment. Where it usually falls short: Deficiencies tracked operationally but never escalated
Requires a system-level continuous monitoring strategy aligned to the organizational one, defining the metrics monitored, the frequencies for monitoring and for assessing control effectiveness, ongoing control assessment, correlation and analysis of the results, response actions, and reporting of security and privacy posture to defined personnel.
What an assessor asks to see: Documented continuous monitoring strategy with metrics and frequencies; Evidence of ongoing control assessments performed at the stated cadence; Correlation and analysis output showing findings drawn from monitoring data; Posture reports issued to the defined personnel and the actions they triggered. Where it usually falls short: Monitoring reduced to vulnerability scanning, with most controls never reassessed
Requirement text quoted from the standards themselves, published at compliance.theartofservice.com, the same publisher as this register, read against the held text of each standard: our statement of each clause, not the instrument verbatim. Run this job through the register