Remote GRC service
Cybersecurity Risk Assessment Services
Remote cybersecurity risk assessment aligned with ISO/IEC 27005 and NIST SP 800-30: asset and threat analysis, 5x5 risk scoring, risk appetite, treatment plans and a working risk register.
A risk assessment tells leadership where security effort and budget should go. It turns a long list of worries into a short, ranked set of business risks, each with an owner and a treatment decision.
Ian runs risk assessments with your team and leaves behind a method and register you can maintain. Available as a consulting project, a fixed-term contract or as part of a full-time remote role, depending on what your organisation needs.
Who it is for
- Organisations that need a risk assessment for ISO 27001, SOC 2, GDPR, cyber insurance or a customer.
- Leadership teams that want a clear view of top cyber risks.
- Teams whose risk register exists but is out of date.
What is included
- Risk method: scales, rating bands and risk appetite statement.
- Asset and threat workshops with business owners.
- Risk register with inherent and residual scores, owners and treatments.
- Heat map and top-risk summary for leadership.
- Risk treatment plan with dated actions.
How it works
- 1Agree the method. Set scales, appetite and sign-off with leadership.
- 2Workshops. Identify assets, threats and weaknesses with the people who run the business.
- 3Score and rank. Rate inherent and residual risk and compare with appetite.
- 4Treat and report. Agree owners and treatments and present the results to leadership.
Frequently asked questions
How long does a cybersecurity risk assessment take?
For a small or mid-sized organisation, typically a few weeks from method agreement to leadership report, depending on scope and how quickly workshops can be scheduled.
What frameworks are used for cyber risk assessment?
Common references are ISO/IEC 27005 and NIST SP 800-30, often combined with a simple 5x5 likelihood and impact matrix that leadership can understand.
Free resources
Work together
Share your role, contract or project and Ian will reply by email to discuss scope and timing.
Go to the request form