Cybersecurity risk assessment: step by step, with a template and worked examples

Cyber risk assessments tend to fail in one of two ways: a 200-row spreadsheet nobody reads, or a single line saying “cyber attack — high”. Here is the middle path: how an SME or risk consultant runs one in a few sessions and records it in a register people actually use.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 13 min read

What a cyber risk assessment is (and is not)

A cyber risk assessment is a structured judgement about which things could go wrong with your information and systems, how much each would hurt, and which ones deserve money and attention first. It is also called an IT or information security risk assessment; “information security” is slightly broader (it includes paper records), but the method is the same.

It is not:

• A vulnerability scan or penetration test. Those find technical weaknesses; they feed the assessment but do not say which weaknesses matter to the business.
• A compliance checklist. A checklist shows what is in place, not whether it is enough for your risks.
• An IT-only exercise. IT knows the systems; finance and operations know what an outage or leak would cost. You need both.

The output is a short list of cyber risks, each written as a specific scenario, with inherent and residual scores, the controls relied on, an owner, a treatment decision and a review date. In other words: a section of your risk register, sometimes called a cyber risk register.

The process, step by step

These steps follow the shape of ISO 31000 and NIST SP 800-30, simplified for organisations without a security team. For 20–200 people, expect two or three 90-minute workshops.

Step 1. Set the scope and the criteria

Decide what is in scope (the whole organisation, one unit or one system) and what is excluded. Then agree the rules before scoring:

• the likelihood and impact scales (see the scales below);
• the score bands and what each band requires;
• your risk appetite for cyber, for example “no tolerance for loss of customer payment data; moderate tolerance for short outages of internal systems”.

Step 2. List the assets that matter

You cannot assess risk to things you have not listed. Build a short inventory of what you would miss most, grouped into:

• Information: customer and payment data, financial records, intellectual property.
• Systems: email and collaboration, finance system, CRM, website, cloud accounts.
• Infrastructure: laptops and phones, firewall and VPN, servers, domain names.
• Suppliers that hold or run any of the above.

For each, note an owner and how critical it is: how long could you operate without it, and what if its contents leaked? Twenty to forty assets is typical for an SME.

Step 3. Identify threats and vulnerabilities

A threat could cause harm: a criminal group, a fraudster, a careless employee, a supplier failure. A vulnerability is a weakness it can exploit: no multi-factor authentication, unpatched software, shared admin accounts, untested backups.

Good sources: your incident and near-miss history, vulnerability scan and penetration test results, guidance from the ACSC (Australia), NCSC (UK) and CISA (US), incidents at peers and suppliers, and a walk-through of who can change bank details, export the customer list or use admin rights.

Step 4. Write each risk as a scenario

Combine an asset, a threat and a vulnerability into one risk statement using a cause → event → consequence structure:

Example: “Because remote access uses passwords only, there is a risk that an attacker with stolen credentials deploys ransomware, leading to two weeks of disruption and possible disclosure of client data.”

“Cyber attack” is not a risk statement: it cannot be scored, owned or tested against a control.

Step 5. Score the inherent risk

For each scenario, score likelihood and impact on a 1–5 scale, assuming your key controls failed or were not there. Multiply for a score out of 25. The inherent score shows which risks depend heavily on controls, and so which controls deserve testing. Our guide to inherent vs residual risk explains why.

Step 6. Assess existing controls and score the residual risk

List the controls that operate today, not those planned. Ask for evidence: an MFA enrolment report, the date of the last successful restore, patch compliance figures. Re-score likelihood and impact with those controls in place.

Preventive controls (MFA, patching, payment call-backs) mostly lower likelihood; detective and recovery controls (monitoring, backups, insurance) mostly lower impact.

Step 7. Evaluate and prioritise

Compare each residual score with your appetite. Risks in the critical band need a treatment plan approved by leadership; significant risks need a plan with owners and deadlines; moderate and low risks can usually be accepted and monitored. Watch high-impact, low-likelihood risks: a score of 5 can hide a business-ending scenario.

Step 8. Decide treatment and assign owners

For each risk above appetite, choose one of four responses:

• Treat: add or strengthen controls, such as MFA or offline backups.
• Transfer: shift part of the financial impact through cyber insurance or contracts; the disruption stays with you.
• Terminate: stop the activity, such as retiring an unused internet-facing server.
• Tolerate: accept it, with a named sign-off and a date to revisit.

Every risk needs one risk owner with the authority and budget to act, usually a business manager rather than IT. Each action needs its own owner and due date.

Step 9. Record, monitor and review

Record the results, report the top cyber risks to leadership and set review frequencies by band. Add a few key risk indicators for the biggest risks, such as critical vulnerabilities unpatched beyond 14 days or the percentage of accounts without MFA. Reassess after any significant change or incident.

Likelihood and impact scales for cyber

Anchor each level with a frequency and a concrete consequence, so “likely” means the same to everyone. Adjust the amounts to your size; these suit a business turning over a few million.

Score bands used in the examples below: 1–4 low 5–9 moderate 10–14 significant 15–25 critical. More in the 5×5 risk matrix guide.

15 example cyber risks with scores and controls

Illustrative scores for a typical services or online retail SME. Borrow the wording; score against your own scales and evidence. L × I = likelihood × impact.

Risk 4 stays significant after controls because the impact of an exploited edge device stays high; the answer is fast, routine patching (see our vulnerability management process guide). Risks 9 and 13 have severe impact, so they belong on the leadership report despite moderate scores. Risk 5 is a supplier risk: organisations with many critical suppliers usually run a separate third-party risk assessment and link it back to the register.

Cyber risk register template

These columns work in any spreadsheet or in our risk register template.

Keep cyber risks in the same register as other risks, tagged “cyber”, so leadership sees them on the same scale as commercial and financial risks.

How the main frameworks fit

Customers, insurers and regulators often ask which framework you follow. This is a summary for orientation; check the current official text before relying on a specific requirement.

ISO/IEC 27001

The standard for an information security management system. Clause 6.1.2 requires a defined information security risk assessment process: establish risk criteria, identify risks to the confidentiality, integrity and availability of information, identify risk owners, analyse likelihood and consequences, and evaluate and prioritise the results. Clause 6.1.3 covers risk treatment, including comparing your chosen controls with the reference list in Annex A and producing a Statement of Applicability. Clause 8.2 requires assessments to be performed at planned intervals and when significant changes occur. In the 2022 edition Annex A lists 93 controls grouped into organisational, people, physical and technological themes. An ISO 27001 risk assessment is the process in this guide plus documented criteria and a control mapping.

NIST Cybersecurity Framework 2.0

Published by the US National Institute of Standards and Technology in February 2024, CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new and covers risk management strategy, roles, policy, oversight and supply chain risk. Risk assessment itself sits mainly in the Identify function. Your risk appetite, owners and register reviews map naturally to Govern.

NIST SP 800-30

NIST’s Guide for Conducting Risk Assessments (Revision 1) describes the method in detail: threat sources and events, vulnerabilities, likelihood and impact. Written for US federal systems, it is heavier than most SMEs need but useful when justifying your method to an auditor.

Essential Eight (Australia)

The Australian Signals Directorate’s Essential Eight is a set of eight mitigation strategies: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups. Each is assessed against maturity levels. It is a control baseline, not a risk assessment method: use the assessment to choose a target maturity level and record gaps as actions in the register. Australian financial services firms will also want to read our guide to CPS 230.

Cyber Essentials (UK)

The UK government-backed certification scheme, run with the NCSC, covers five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Cyber Essentials Plus adds independent technical testing. It is required for some UK government contracts. Like the Essential Eight, it is a minimum baseline and does not cover business-specific risks such as payment fraud or supplier dependency.

A sensible SME pattern: the risk assessment sets priorities, Essential Eight or Cyber Essentials sets the baseline, and ISO/IEC 27001 follows if customers require certification. The underlying principles are in our ISO 31000 guide.

Common mistakes

• Vague risk statements. Write the scenario, not “data breach”.
• Scoring the controls you plan, not the ones you have. Residual risk reflects what works today, with evidence. Planned controls belong in the target score.
• IT owning every cyber risk. The person who can approve budget and change a business process should own the risk. IT often owns the actions.
• Ignoring payment fraud. Business email compromise is often left to finance and missed from the cyber assessment.
• Trusting untested backups. A backup never restored is an assumption, not a control.
• One assessment, then nothing. Review critical cyber risks monthly and the whole set at least annually.