---
schema_version: "1"
id: ee30a754968bd73cad54e316bcfd6515497e86233ad6a1dd354a597c04004121
title: Register Risks
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_create_risks.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_create_risks.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a833bf398186d3d945c8d9b9a7371f914e568ccabd31d57d5ea0d9618252b4c7
description: Log vulnerabilities and threats in your IT environment by creating risk records. You can quickly create a risk using a predefined risk scenario, or create a risk directly from the Risks tab in the IT Compliance app.
products:
  - Service Cloud
  - Agentforce IT Service
release: "264"
---
# Register Risks

Log vulnerabilities and threats in your IT environment by creating risk records. You can quickly create a risk using a predefined risk scenario, or create a risk directly from the Risks tab in the IT Compliance app.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions with Agentforce IT Service.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d84686e74">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d84686e74 ">To register risks:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d84686e74 ">Compliance Admin permission set</td>

          </tr>
        </tbody>
      </table>

A risk record represents a specific threat your team has acknowledged in your IT environment, like a phishing attempt against a particular tenant or a data retention failure for a specific customer dataset. Most risks are registered from a Risk Scenario in the library, so the new record inherits the standardized name, description, category, and source framework. When no scenario fits, register the risk directly from the Risks tab.

1. From App Launcher, go to the IT Compliance app and select **Risk Scenario Library**.
2. Click the dropdown next to **Add** and select **Register Risk**. To start from an existing scenario, select **Register Risk** from the dropdown next to that scenario instead.
3. Fill in the risk details:
    
    - Risk Name. The name of the specific risk you're registering. Add detail that distinguishes it from other risks built on the same scenario, like the affected business unit, vendor, or asset.
    - Description. Inherits the scenario's description by default. Refine it if this risk has specifics worth capturing, such as a particular threat vector or environment.
    - Category. Inherits from the scenario.
    - Owner. The person accountable for managing the risk, usually a Risk Manager, security lead, or business unit owner.
    - Risk Scope. The business units, vendors, configuration items, or assets the risk applies to. Scope is what turns the abstract scenario into a concrete, trackable risk.
4. Save your changes.

![Example: registering a phishing risk for a specific business unit](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_example.png)

Example: registering a phishing risk for a specific business unit

Suppose your compliance team uses the Phishing Attack scenario from the library to register a phishing risk specific to your North America Sales business unit. The new risk record inherits the scenario's defaults but adds the specifics that make it actionable:

- Risk Name: Phishing Attack — North America Sales
- Risk Scenario: Phishing Attack (linked from the library)
- Description: Inherited from the scenario. Attackers attempt to steal credentials or deliver malware by impersonating a trusted source through email, SMS, or messaging.
- Category: Inherited. Cybersecurity
- Owner: Jordan Kim, CISO for North America
- Risk Scope: North America Sales tenant, Salesforce Sales Cloud, ~1,200 user accounts

For the new risk record, the inherent risk score is auto-populated. Your team can now link mitigating controls, associate the risk to specific policy clauses, and conduct evaluations to calculate the residual score.