Before You Start
- An inventory of IT assets including hardware, software, data, and cloud services
- Support from executive leadership to dedicate time and resources to the assessment
- Access to system administrators and department heads for interviews
- Understanding of your industry regulatory requirements
Define the assessment scope and methodology
Before starting, clearly define what is in scope for the assessment. This could be the entire organization, a specific department, a particular system, or a regulatory requirement like HIPAA or PCI DSS. Choose a risk assessment framework to follow. NIST SP 800-30 is a widely accepted methodology suitable for SMBs. It defines risk as the product of the likelihood of a threat exploiting a vulnerability and the impact if it occurs. Define your rating scales for likelihood and impact using a simple three-level or five-level scale. For example, likelihood can be rated as Low, Medium, or High based on historical data and threat intelligence. Impact can be rated based on financial loss, operational disruption, regulatory penalties, and reputational damage. Document your methodology so the assessment is repeatable and consistent across future iterations.
Identify and value critical assets
Create a comprehensive inventory of assets that could be affected by a security incident. Group assets into categories including hardware like servers, workstations, and network equipment. Include software and applications, especially those processing sensitive data. Document data assets by type such as customer PII, financial records, intellectual property, and employee records. Include cloud services and SaaS applications. For each asset, assign a value based on its importance to business operations. Consider what would happen if the asset were unavailable for a day, a week, or permanently. Consider the regulatory implications of a breach involving that asset. Rank assets from most critical to least critical. This prioritization ensures you focus the detailed threat and vulnerability analysis on the assets that matter most to your business rather than spending equal time on every device.
Identify threats and threat sources
For each critical asset, identify the threats that could compromise it. Threats fall into several categories. External threats include cybercriminals using ransomware or phishing, nation-state actors, hacktivists, and competitors engaged in corporate espionage. Internal threats include malicious insiders, negligent employees who accidentally expose data, and former employees with lingering access. Environmental threats include natural disasters, power outages, and hardware failures. For each threat, assess the likelihood based on your industry, geographic location, and organization profile. Healthcare and financial services face higher rates of targeted attacks. Organizations in certain regions face higher natural disaster risk. Use industry threat reports from sources like the Verizon Data Breach Investigations Report and FBI Internet Crime Report to ground your likelihood assessments in real data rather than speculation.
Assess vulnerabilities for each asset and threat pair
For each asset-threat combination, identify the vulnerabilities that a threat could exploit. Vulnerabilities include technical weaknesses like unpatched software, weak configurations, and missing security controls. They also include process weaknesses like lack of security awareness training, no incident response plan, or inadequate backup procedures. Use the results from your Cyber Defense Score scan to identify technical vulnerabilities in your email and web configurations. Conduct interviews with system administrators and department heads to uncover process and procedural gaps. Review recent security incidents and near-misses for patterns. For each vulnerability, assess how easily it could be exploited and whether existing controls partially mitigate the risk. Document the current state of controls for each vulnerability, noting whether a control is fully implemented, partially implemented, or missing entirely.
Calculate risk levels and create the risk register
For each risk scenario combining an asset, threat, and vulnerability, calculate the risk level by combining the likelihood score and the impact score. Use a risk matrix that maps these two dimensions to an overall risk level of Low, Medium, High, or Critical. Create a risk register document or spreadsheet that lists every identified risk with its description, affected asset, threat source, vulnerability, likelihood rating, impact rating, overall risk level, existing controls, and recommended additional controls. Sort the register by overall risk level with critical and high risks at the top. The risk register becomes your primary tool for communicating risks to leadership and prioritizing security investments. For each high and critical risk, propose specific mitigation actions with estimated costs and timelines. For medium risks, document them for future action. For low risks, document and accept them.
Present findings and create a remediation roadmap
Prepare an executive summary of the risk assessment findings that highlights the total number of risks identified, the distribution across risk levels, and the top five risks requiring immediate attention. Present this to executive leadership and key stakeholders. For each high and critical risk, present the recommended mitigation action, estimated cost, timeline for implementation, and the expected risk reduction. Get approval and budget for the remediation roadmap. Prioritize quick wins that are low-cost and high-impact alongside longer-term investments in security infrastructure. Assign owners for each remediation action and set milestone dates. Schedule a follow-up assessment in six to twelve months to measure progress and identify new risks. The risk assessment should not be a one-time event but an ongoing process that adapts as your threat landscape and business environment evolve.
Common Mistakes to Avoid
Treating the risk assessment as a one-time compliance checkbox instead of an ongoing process
Assessing only technical vulnerabilities and ignoring process and human factors
Not involving business stakeholders, resulting in an assessment that misses critical assets and processes
Using overly complex methodologies that produce impressive documents but no actionable outcomes
Failing to present findings in business terms that executives can understand and act on
Get your Cyber Defense Score™ in 60 seconds.
100 tools. No installation. No credit card.
Get My Cyber Defense Score™ →