What is a cybersecurity risk assessment?
Short answer
A risk assessment identifies what you need to protect, the threats and weaknesses that could affect it, how likely and how damaging each scenario is, and which risks to treat first. The result is a prioritized list of risks with owners and planned actions.
The details
NIST SP 800-30 gives a detailed method. For a small organization, a workshop that lists key systems and data, scores scenarios on a simple likelihood and impact scale, and records decisions in a risk register is enough to start.
What to do
- List critical systems, data and processes.
- Identify realistic threats and weaknesses for each.
- Score likelihood and impact.
- Decide to reduce, accept, transfer or avoid each risk.
- Record owners and deadlines in a risk register.
Useful next reads and tools
Terms explained
- Risk assessment
- A cybersecurity risk assessment identifies assets, threats and weaknesses, estimates likelihood and impact, and prioritizes how to treat each risk.
- Risk register
- A risk register is a maintained list of risks with their likelihood, impact, owner, controls, treatment plan and review date.
Sources
Related questions
Related Guides
GuideGRC
How to Do a DPIA: A Step-by-Step Security and Privacy Guide
Learn how to do a DPIA step by step. Identify privacy risks, assess necessity and proportionality, and implement controls to protect personal data.
Read more GuideGRC
8 AI Vendor Risk Assessment Questions for Your Business
Review these 8 essential AI vendor risk assessment questions before adopting third-party artificial intelligence tools to protect your business data.
Read more