How to Conduct a Cybersecurity Risk Assessment in 7 Steps
A step-by-step method for information security risk assessment aligned with ISO 27005 and NIST SP 800-30: assets, threats, likelihood and impact scoring, risk appetite, treatment and the risk register.
A risk assessment is how an organisation decides where to spend its security effort. Done well, it gives leadership a short, defensible list of the risks that matter, who owns them and what is being done about them.
This tutorial follows the approach in ISO/IEC 27005 and NIST SP 800-30, simplified for teams that need a working process rather than a research project. Follow along in the free Cyber Risk Register, which scores risks on a 5x5 matrix and exports a CSV register.
Step 1: Agree the Method and Risk Appetite
Before identifying a single risk, agree how risks will be rated and what level of risk leadership is willing to accept. Without this, two people will score the same risk differently and nobody will know when a risk is "too high".
A 5-point scale for likelihood and impact is common and easy to explain. Multiply them for a score from 1 to 25 and define bands:
| Score | Rating | Typical response |
|---|---|---|
| 1 to 4 | Low | Accept and monitor |
| 5 to 9 | Medium | Treat within normal planning, or accept with owner sign-off |
| 10 to 14 | High | Treat with a dated plan; report to management |
| 15 to 25 | Critical | Act now; escalate to senior leadership |
Step 2: Identify Assets and Their Value
List the information and services that matter: customer and employee data, intellectual property, financial systems, the production platform, email and identity. Group them sensibly; assessing every laptop individually adds effort without insight.
For each asset, note what would hurt most if it were exposed (confidentiality), altered (integrity) or unavailable (availability). This becomes the basis for impact ratings.
Step 3: Identify Threats and Vulnerabilities
For each asset, ask what could realistically go wrong. Use threat intelligence, past incidents, audit findings, vulnerability scans and supplier reviews as inputs. Write each risk as a short scenario that a non-specialist understands.
- Ransomware encrypts file servers and backups, halting operations for several days.
- An attacker takes over a finance mailbox through phishing and redirects a supplier payment.
- A cloud storage bucket holding customer exports is misconfigured as public.
- A critical SaaS supplier suffers a breach that exposes our customer records.
- A departing employee keeps access to the CRM and downloads the customer list.
Step 4: Rate Likelihood and Impact
Rate the inherent risk first: likelihood and impact considering the threat and weakness, before counting the controls you rely on. Then rate the residual risk with current controls in place. The gap between the two shows how much the controls are worth, which helps when budgets are reviewed.
Define the scales in concrete terms so ratings are consistent. For example, impact 5 might mean "regulatory notification, more than 10,000 records or more than one week of disruption", and likelihood 5 might mean "expected within the next year".
Step 5: Evaluate Against Risk Appetite
Compare each residual score with the appetite agreed in step 1. Anything above it needs a treatment decision. Rank what remains so leadership sees the top risks first; a heat map is the fastest way to show the overall picture.
Step 6: Choose a Treatment and an Owner
ISO 27005 describes four options. Each risk needs one owner: a person with the authority and budget to make the decision, usually a business leader rather than the security team.
- Modify (mitigate): add or improve controls, such as MFA, backups or monitoring.
- Avoid: stop the activity, such as retiring an unsupported system.
- Share (transfer): use insurance or contractual terms with a supplier.
- Retain (accept): document that the owner accepts the risk, with a review date.
Record the planned actions, due dates and the target residual score. Link related policy exceptions and DPIA findings to the same register entry.
Step 7: Record, Report and Review
Keep everything in one risk register: risk ID, scenario, asset, owner, inherent score, controls, residual score, treatment, actions, due date and next review date. Review high and critical risks monthly and the whole register at least quarterly, and update it after incidents or significant changes.
Report the top risks, overdue treatments and trend to management. The compliance reporting guide shows how to present risk to executives and committees.
ID,Risk,Asset,Owner,Inherent (LxI),Controls,Residual (LxI),Treatment,Due,Review
R-007,"Finance mailbox takeover redirects supplier payment",Email and finance,CFO,4x5=20,"MFA; payment call-back check",2x4=8,Modify,2026-12-15,2027-01-15Step-by-Step Checklist
- 1Agree the method
Define likelihood and impact scales, rating bands and the risk appetite leadership will accept.
- 2Identify assets
List the information and services that matter and what confidentiality, integrity or availability loss would mean.
- 3Identify threats and vulnerabilities
Write realistic risk scenarios using threat intelligence, incidents, scans and audit findings.
- 4Rate likelihood and impact
Score inherent risk before controls and residual risk with current controls in place.
- 5Evaluate
Compare residual risk with the agreed appetite and rank the results.
- 6Treat and assign owners
Choose to modify, avoid, share or retain each risk, with one accountable owner and dated actions.
- 7Record and review
Keep a risk register, report top risks to management and review on a schedule.
Frequently Asked Questions
What is the difference between inherent and residual risk?+
Inherent risk is the level of risk before considering the controls you rely on. Residual risk is what remains with current controls in place. Comparing them shows how much your controls reduce risk.
How often should a cybersecurity risk assessment be done?+
Run a full assessment at least once a year, review high risks monthly and the register quarterly, and reassess after major incidents, acquisitions or technology changes.
Who should own a cybersecurity risk?+
A person with the authority and budget to decide how the risk is treated, usually the business leader responsible for the affected process or asset rather than the security team.