Most management teams accept that cyber risk is real, yet struggle with a simple question: which three security problems would hurt this business most, and what will it take to fix them? Scanner output and audit observations do not answer that on their own.
A cybersecurity risk assessment does. This guide walks through the steps, from deciding what matters to building a risk register and a 90-day plan. You can run a first version internally, and you will know what to expect if you bring in an outside assessor.
Quick answer: A cybersecurity risk assessment identifies your critical systems and data, the threats and weaknesses that could affect them, and scores each risk by likelihood and business impact. The result is a risk register and a prioritised plan that tells management which risks to reduce, transfer, accept or avoid, who owns each one and in what order to act.
Step 1: decide what matters most
Start with the business, not the technology. Ask each department head one question: if this system or data were unavailable, leaked or altered for a week, what would happen?
- Systems that stop revenue: billing, ERP, e-commerce and payment integrations.
- Data that creates liability: customer personal data, employee records, financial data and health records.
- Shared dependencies: email, identity platforms such as Microsoft 365 or Google Workspace, your domain and DNS, and cloud accounts.
- Intellectual property: source code, designs, pricing and contracts.
This becomes your list of crown jewels. Keep it short enough for management to read in a minute.
Step 2: map the assets around them
For each crown jewel, record where it runs, who can reach it and what it depends on.
- Applications and servers, including cloud accounts and SaaS tools.
- Network paths: office internet, VPN, Wi-Fi and remote access.
- People and roles with access, including vendors and former staff accounts that were never removed.
- Backups: where they are, how often they run and when a restore was last tested.
Expect surprises: a forgotten test server, a subdomain pointing at an old hosting account, a vendor with permanent remote access. External attack surface discovery is the technical way to find them.
Step 3: identify threats and weaknesses
Focus on realistic scenarios for your business rather than every threat in the textbook. For most Indian SMEs and mid-sized companies, the list starts with:
- Ransomware entering through phishing or an exposed remote desktop service.
- Business email compromise used to change a vendor's bank details on an invoice.
- A web application flaw that exposes customer records.
- An employee or vendor misusing legitimate access.
- A cloud misconfiguration, such as a publicly readable storage bucket.
- Loss of a single critical person or system with no backup.
For each scenario, note the weaknesses that make it possible: no MFA, unpatched servers, shared admin passwords, untested backups or missing logs.
Step 4: score likelihood and impact
Use a simple 1 to 5 scale for each, then multiply them to get a risk score out of 25. Define the scale in business terms, so different people score consistently.
| Score | Likelihood | Impact |
|---|---|---|
| 1 | Unlikely in the next few years | Minor inconvenience, no data or revenue loss |
| 2 | Possible, but controls make it hard | Short disruption, internal data only |
| 3 | Could happen this year | A day or more of disruption, or limited customer data exposed |
| 4 | Likely this year | Major disruption, regulatory reporting, customer impact |
| 5 | Expected, or already happening | Business-threatening loss, large data breach or legal action |
Then set thresholds. For example, you might put scores of 15 and above on the management agenda, give 8 to 14 a planned fix and monitor the rest. Choose thresholds that match your appetite for risk, and write them down so the next assessment uses the same rules.
Step 5: build the risk register and choose a treatment
The risk register is a table with one row per risk: description, affected assets, likelihood, impact, score, owner, treatment and due date. For each risk, choose one of four treatments:
- Reduce: add controls such as MFA, patching, network segmentation or offline backups.
- Transfer: share the financial impact, for example through cyber insurance or contract terms, while keeping the controls insurers expect.
- Accept: record that management accepts a low risk, with a date to review it.
- Avoid: stop the risky activity, such as retiring an unsupported server.
Every risk needs a named owner in the business, not only in IT. If you are working towards ISO 27001, this register is the core of the risk assessment the standard requires, so build it in a form you can reuse.
Step 6: turn it into a roadmap and repeat
Group the treatments into three horizons: immediate fixes for high scores that need little effort, a 90-day plan for larger control changes, and a 180-day plan for structural work such as redesigning identity and access or a new backup architecture. Re-run the assessment at least once a year and after major changes such as a cloud migration, an acquisition or a serious incident.
What to present to management
Leadership does not need the full register. Give them a short pack they can act on in one meeting:
- One-page summary: the top five risks in plain language, each with its business consequence.
- Heat map: all risks plotted by likelihood and impact, so the spread is visible at a glance.
- Decisions needed: risks that need budget, a policy change or formal acceptance.
- Progress: what has improved since the last review, and what is overdue.
An outside review such as our enterprise security assessment adds technical evidence to this process: attack surface discovery, configuration reviews and access audits that confirm whether a weakness is real and how exposed it is.
How EthicsComputer can help
Our cybersecurity assessment service covers attack surface discovery, architecture and access reviews, data protection, backup resilience and an executive risk roadmap, typically over two to three weeks. Where the register points to specific technical gaps, our vulnerability assessment and ISO 27001 readiness services take the work further.
Does your management team know its top three cyber risks?
Tell us about your business and systems, and we will suggest how to scope an assessment.
About the author
Vinay Grover founded EthicsComputer in Rohtak, Haryana in 2018 and leads its cybersecurity, software and AI work for clients across India and abroad. EthicsComputer is ISO 9001, ISO/IEC 27001 and ISO 20000-1 certified.
