Security Asset and Risk Register Schema

erDiagram
  OWNER ||--o{ ASSET : owns
  ASSET ||--o{ VULNERABILITY : "found on"
  ASSET ||--o{ RISK_ASSET : "exposed in"
  RISK ||--|{ RISK_ASSET : affects
  RISK ||--o{ RISK_CONTROL : "mitigated by"
  CONTROL ||--o{ RISK_CONTROL : mitigates
  RISK ||--o{ EXCEPTION : "accepted via"
  OWNER {
    int id PK
    string name
    string team
  }
  ASSET {
    int id PK
    int owner_id FK
    string name
    string type
    string criticality
  }
  VULNERABILITY {
    int id PK
    int asset_id FK
    string cve_id
    decimal cvss
    string status
  }
  RISK {
    int id PK
    string title
    int likelihood
    int impact
  }
  RISK_ASSET {
    int risk_id PK, FK
    int asset_id PK, FK
  }
  CONTROL {
    int id PK
    string framework_ref
    string description
  }
  RISK_CONTROL {
    int risk_id PK, FK
    int control_id PK, FK
  }
  EXCEPTION {
    int id PK
    int risk_id FK
    string approver
    date expires_on
  }