The short answer
A cyber security risk assessment (or cybersecurity risk assessment) identifies the information and systems you rely on, the threats and weaknesses that could affect them, and how likely and damaging each would be. The output is a scored risk register and a treatment plan that says which risks you will reduce, avoid, transfer or accept. Review it every 12 months.
On this page
- What is a cyber security risk assessment?
- How do you carry out a cyber security risk assessment in 6 steps?
- Cyber security risk assessment template: what does a risk register look like?
- What are your options for treating a risk?
- How often should you do a cyber risk assessment?
- Who should carry out the risk assessment?
- How does a cyber risk assessment support ISO 27001, PCI DSS and UK GDPR?
- What is the difference between a risk assessment and an audit?
- What are the most common risk assessment mistakes?
- Why Sovereign Secure
- Next step
A cyber security risk assessment is how you work out which cyber threats could genuinely hurt your organisation and which to deal with first. You identify the information, systems and services you depend on, the threats and weaknesses that could affect them, and how likely and damaging each scenario would be. The output is a scored risk register and a treatment plan that names an owner, an action and a deadline for every significant risk.
Done well, it justifies your security budget. Done badly, it is a spreadsheet of generic threats nobody reads. The difference is the method, set out below.
What is a cyber security risk assessment?
A cyber security risk assessment estimates the likelihood and impact of threats exploiting weaknesses in the things you depend on. Risk is the combination of the two: a likely event with a small impact can matter less than a rare event that would stop the business. Impact is usually judged against the CIA triad: what a risk would do to the confidentiality, integrity and availability of your information.
You will see several names for the same work:
- Cyber risk assessment or cyber security risk assessment: digital threats to systems, data and services.
- IT risk assessment or IT security risk assessment: usually narrower, focused on technology.
- Information security risk assessment: broader, covering all information, including paper, people and suppliers. This is the term ISO 27001 uses.
The method below works for all three. Change the scope, not the approach.
How do you carry out a cyber security risk assessment in 6 steps?
Work through six steps. The NCSC publishes a basic risk assessment and management method that follows the same logic, and it is a good companion to this guide. For where risk management sits among the other nine areas, see our map of the NCSC 10 Steps to Cyber Security.
- Set the context and scope. Agree which parts of the organisation are in scope, your business priorities, your legal and contractual obligations, and how much risk the board is willing to carry. Define your scoring scales now, before anyone scores anything.
- Identify what matters. List the information, systems, services, suppliers and people the business depends on, and give each an owner. Ask what would happen if each were unavailable, leaked or altered.
- Identify threats and vulnerabilities. For each important asset, list who or what could cause harm (criminals, insiders, supplier compromise, human error, outages) and the weaknesses they could use.
- Assess existing controls. Record what already reduces the risk, and how confident you are that it works. Test results are better evidence than assumptions.
- Score likelihood and impact. Rate each scenario on your agreed scales and combine them into a risk score.
- Evaluate and decide. Compare each score with your risk appetite, decide how to treat it, and record the decision, owner and date.
Example likelihood and impact scales
The NCSC warns that risk matrices can lead to errors and miscommunication if the meaning of each scale is not carefully communicated. Write the definitions down. These are examples to adapt, not a standard:
| Score | Likelihood | Impact |
|---|---|---|
| 1 | Rare: not expected within five years | Minimal: no customer effect, fixed within a day |
| 2 | Unlikely: could happen within five years | Minor: brief disruption, small internal cost |
| 3 | Possible: could happen within two years | Moderate: service outage of hours, some customers affected |
| 4 | Likely: expected within a year | Major: multi-day outage, reportable data breach or lost contract |
| 5 | Almost certain: already happening to similar organisations | Severe: threat to the business, regulatory action or major loss |
Multiply likelihood by impact to get a score from 1 to 25, then band the results so everyone reads them the same way: 1 to 4 low, 5 to 9 medium, 10 to 16 high and 20 to 25 critical.
Cyber security risk assessment template: what does a risk register look like?
The risk register is the main output. Each row is one risk scenario, written so a non-specialist understands it. Our free cyber security risk assessment template (Excel) has the columns below, plus threat, vulnerability, scoring rationale and treatment actions. For ISO 27001 scales, acceptance criteria and worked examples, see our ISO 27001 risk assessment template guide. A short extract:
| Risk scenario | Score (likelihood x impact) | Treatment | Owner |
|---|---|---|---|
| Phishing email leads to ransomware that encrypts the file server and backups | 4 x 5 = 20, Critical | Reduce: MFA everywhere, endpoint protection, offline backups with tested restores, phishing simulation | IT manager |
| Compromised supplier account with remote access reaches internal systems | 3 x 4 = 12, High | Reduce: named supplier accounts, MFA, access only when needed, logging | Operations director |
| Malicious script on the online checkout page skims card details | 2 x 5 = 10, High | Reduce: payment page script controls (PCI DSS 6.4.3 and 11.6.1), or move to a hosted payment page | E-commerce lead |
| Unencrypted laptop with customer data is lost | 3 x 3 = 9, Medium | Reduce: full-disk encryption and remote wipe | IT manager |
| Cloud provider region outage stops the customer portal | 2 x 3 = 6, Medium | Accept, with a documented recovery plan | Head of product |
Alongside the register, a risk treatment plan lists each action, its owner, budget, due date and the target score once it is done. Re-score the risk when the action is complete so the register shows progress.
What are your options for treating a risk?
Every significant risk needs one of four decisions, recorded with a reason.
| Option | What it means | Example |
|---|---|---|
| Reduce | Add or improve controls to lower likelihood or impact | Enforce MFA on all cloud services |
| Avoid | Stop the activity that creates the risk | Stop storing card numbers you do not need |
| Transfer or share | Move part of the financial impact to someone else | Cyber insurance, or outsourcing to a specialist provider |
| Accept | Carry the risk knowingly, within your appetite | A low-scoring risk where the fix costs more than the loss |
Transferring a risk rarely transfers accountability. If a supplier loses your customers’ data, you still answer to your customers and the regulator.
How often should you do a cyber risk assessment?
Review the full assessment at least once every 12 months, and update it whenever something significant changes. Triggers include:
- a new system, cloud platform or major software release
- a merger, acquisition or new line of business
- a new supplier with access to your systems or data
- a serious incident or near miss, inside or outside your organisation
- a change in law, regulation or customer contract terms
- a penetration test or audit that reveals weaknesses you had not scored
High and critical risks deserve a monthly or quarterly check on their treatment actions, not just the annual review.
Who should carry out the risk assessment?
The business owns the risks; security staff facilitate. Process owners know what a disruption would really cost, and security specialists know how attacks happen. You need both in the room. The board or senior management should set the risk appetite, approve the results and track the critical risks. The UK government’s Cyber Governance Code of Practice, published in April 2025, sets out what boards and directors should do to govern cyber risk.
An external facilitator helps when you lack threat knowledge in-house or need challenge from someone with no stake in the scores. Where nobody senior owns security day to day, a virtual CISO (vCISO) is one way smaller organisations get that challenge on an ongoing basis.
How does a cyber risk assessment support ISO 27001, PCI DSS and UK GDPR?
A good general risk assessment feeds several frameworks, but it does not replace their specific requirements.
| Framework | What it asks for | Does a general cyber risk assessment cover it? |
|---|---|---|
| ISO 27001 | A defined, repeatable information security risk assessment and treatment process | It is a strong starting point; the standard adds specific requirements, covered in our ISO 27001 risk assessment guide |
| PCI DSS v4.0.1 | A targeted risk analysis for each requirement that lets you set how often a control runs and calls for one (Requirement 12.3.1, mandatory since 31 March 2025), reviewed at least every 12 months | No. Each is a separate document; see our guide to the PCI DSS targeted risk analysis |
| UK GDPR | Security measures appropriate to the risk to personal data (Article 32) | It helps show your measures are proportionate; see the ICO’s guide to data security |
| Cyber Essentials | Five fixed technical controls, whatever your risk profile | Not needed to certify, but it tells you what to do beyond the baseline |
What is the difference between a risk assessment and an audit?
A risk assessment decides what matters most; an audit checks whether your controls meet a benchmark. They are often confused with gap analysis and penetration testing because all four use similar evidence.
| Activity | The question it answers | Main output |
|---|---|---|
| Risk assessment | What could go wrong, and how much would it matter? | Risk register and treatment plan |
| Cyber security audit | Do our controls meet the benchmark, and do they work? | Findings against criteria, maturity score |
| ISO 27001 gap analysis | How far are we from meeting ISO 27001? | Gap register and roadmap to certification |
| Penetration test | Can an attacker actually get in? | Exploited vulnerabilities and fixes |
Technical testing makes your likelihood scores honest. A score of “unlikely” for an internet-facing system means little until penetration testing or vulnerability scanning has looked at it.
What are the most common risk assessment mistakes?
- Scoring before agreeing what each number means, or rating everything “medium”.
- Listing generic threats with no link to a business process or asset.
- Leaving out suppliers. IT providers with remote access and cloud services holding your data belong in the assessment, and high-scoring ones need a proper third-party risk management process.
- Treating the assessment as a one-off document for an auditor, with no owners or review dates.
Why Sovereign Secure
Sovereign Secure Ltd was incorporated in 2012 and is headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. Risk assessment runs through the services we already deliver:
- ISO 27001. We are ISO 27001 certified, so our own management system rests on a documented risk assessment. Our ISO 27001 consultancy includes the risk assessment and Statement of Applicability. Certification audits are carried out by our partner certification body, MQA International.
- PCI DSS. We are a PCI SSC Qualified Security Assessor (QSA) company, Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA), and a GEAR member for 2026 to 2028. Our PCI DSS consultancy helps you write the targeted risk analyses v4.0.1 requires.
- Evidence for likelihood. Penetration testing and vulnerability scanning show which weaknesses are real. External ASV scans run through a PCI SSC Approved Scanning Vendor partner.
- Cyber Essentials. We are an IASME-licensed certification body for Cyber Essentials and Cyber Essentials Plus, the baseline most treatment plans start from.
Next step
Tell us what the risk assessment is for (ISO 27001, PCI DSS, a customer questionnaire or the board) and we will tell you which of our services fits. Contact our team or call +44 161 523 5276.
Starting on your own? Download the free risk register template (Excel) and work through the six steps above. If ISO 27001 is the goal, our free ISO 27001 checklist shows what the standard adds.
Free tools and services
- PCI compliance checkAnswer 22 questions for a readiness score, your likely SAQ and a fix list.Start the free check
- Cyber Essentials readiness checkAnswer 20 questions for a readiness score and a fix list before you apply.Start the free check
- Talk to usTell us what you need. We aim to reply within one working day.Get a quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
