Skip to main content
Risk assessment is the process of identifying, analyzing, and evaluating risks to your organization’s information assets. Regentra provides structured workflows for conducting assessments and maintaining an ongoing risk register — a requirement across most compliance frameworks.

​
Creating a Risk Assessment

1

Navigate to Risk Assessment

Open the Compliance module and select Risk Assessment from the sidebar.
2

Start a new assessment (Setup)

Click New Assessment. Name the assessment, note who’s conducting it, choose a Methodology — NIST SP 800-30 Rev 1 (recommended), NIST SP 800-66 Rev 2, HHS SRA Tool v3.6, ISO 27001 / ISO 27005, or a custom Qualitative Analysis — and set the next review date.
3

Define scope & assets

Describe which systems, applications, and locations are in scope (the default text is written for a HIPAA ePHI scope and can be edited for other frameworks), list the asset inventory, and optionally note any threats already known.
4

Review and create

Confirm the summary and click Create Assessment.
5

Add findings and score

From the assessment’s Findings tab, add risk findings from the pre-populated threat library or as custom entries, rate each by likelihood and impact, attach supporting evidence, and define remediation plans with owners.
For HIPAA-covered entities and business associates, the Security Risk Assessment is not optional. The HHS Office for Civil Rights (OCR) cites failure to conduct an SRA as one of the most common HIPAA violations.

​
Risk Scoring Methodology

Regentra uses a 3×3 likelihood × impact lookup calibrated against the HHS/ONC SRA Tool v3.6.1 Risk_Logic matrix. A customer running both Regentra and the SRA Tool workbook sees consistent scores.

​
The matrix

Each cell is the inherent risk for that combination. Notable cells that surprise some operators:
  • Moderate × High = Critical (high-impact events deserve immediate attention even at moderate likelihood)
  • High × High = Critical
  • Low × High = High (a low-probability but catastrophic event is still a high-priority finding)
Regentra also accepts a fourth “Critical” tier on both likelihood and impact (for findings the operator wants to flag as effectively-certain, or catastrophic). Any row/column using Critical produces a result at least as high as the corresponding High row/column, never lower.
When scoring risks, involve the people closest to the systems in question. Technical staff understand vulnerabilities better than anyone, and business stakeholders understand impact more accurately.

​
Alignment with the HHS/ONC SRA Tool

For HIPAA-covered entities, Regentra is structured to map 1:1 against the HHS/ONC SRA Tool v3.6.1 workbook. The alignment touches every layer of the risk-assessment surface:
  • All 60 SRA Tool §refs are covered by Regentra’s HIPAA 2026 framework requirements. The 5 sub-clauses the SRA Tool checks but the prior version of Regentra hadn’t surfaced (§164.316(b)(2)(i/ii/iii) for documentation hygiene, §164.314(a)(2)(i)(A) and §164.314(a)(2)(iii) for BA contract clauses) are now present.
  • Canonical 40-entry threat catalog. When you create a Finding, the Threat Library picker has two tabs: a generic NIST/OCR-derived catalog and the HHS SRA Tool catalog. Threats picked from the SRA tab carry a stable code (e.g., SRA-S4-T1) and surface in audit-package exports as “X of Y findings came from the SRA Tool catalog.”
  • Per-§ref question reference. On each control card, a collapsible “HHS SRA Tool questions for §164.xxx” panel shows the SRA Tool’s questions probing that §ref, with HHS’s multiple-choice answers and per-answer compliant/risk-indicated markers. Read-only reference for customers running both tools in parallel.
  • Risk-matrix calibration (the table above) matches the SRA Tool’s Risk_Logic exactly on the LOW/MEDIUM/HIGH subset.
See Working with Controls for the per-control question panel.

​
Risk Register

Every risk identified during an assessment feeds into the Risk Register — your organization’s living inventory of identified risks, with scoring, treatment plans, tolerance/appetite settings, gated acceptance and closure, and review-cadence tracking. The register now has its own full page: see Risk Register for how to add a risk, treatment plans (Mitigate, Accept, Transfer, Avoid), the current status list, tolerance and acceptance gates, and everything else the register does.

​
Annual Review Requirements

Most compliance frameworks require risk assessments to be reviewed and updated on a regular cadence:
  • HIPAA — annual SRA review is a best practice and OCR expectation
  • SOC 2 — risk assessments must be current for each audit period
  • NIST CSF — recommends ongoing risk assessment as part of the Identify function
  • ISO 27001 — requires risk assessment updates when significant changes occur or at planned intervals
Do not let assessments go stale — outdated risk assessments are a common audit finding and regulatory citation.
Each assessment’s next-review date is tracked and shown on the Compliance Calendar, so your team can plan the next assessment cycle in advance.