diff --git a/analysis/threat-register.md b/analysis/threat-register.md
new file mode 100644
index 0000000..283d863
--- /dev/null
+++ b/analysis/threat-register.md
@@ -0,0 +1,10 @@
+# Threat Register — Phoenix Salon + Spa
+
+**Date:** 2026-08-05
+**Status:** Initialized — pending Layer 2 threat diagnosis
+
+| # | Threat | Category | Severity | Evidence Tier | Status |
+|---|--------|----------|----------|---------------|--------|
+| — | *Audit pending* | — | — | — | Pending |
+
+*Populated during Layer 2 threat diagnosis per the Audit Playbook.*