How to Assess Cyber Risk: A Plain-Language Method for Business Owners

Every business faces more cyber risks than it can address at once. Assessing cyber risk is how you decide which ones deserve attention and money first. You do not need to be a security specialist to start. You need a clear view of what the business depends on, an honest look at current controls and a simple way to compare one risk with another.

Key Takeaways

• Start with what the business cannot run without, then trace what each critical system depends on.
• Rate each existing control as effective, partial or absent; partial controls deserve the closest look.
• Score each risk from one to five for likelihood and impact, and judge impact in business terms.
• Keep a risk register with a named owner and a specific review date for every risk.

What a cyber risk assessment answers

A good assessment answers three questions in business terms: what matters most to keep running, what could realistically go wrong with it and which improvements reduce the most risk for the effort involved. The output is a ranked list with owners and dates, not a pile of technical findings.

Step 1: Identify what the business cannot run without

List the systems and data the business depends on: email, the accounting system, the line-of-business application, customer records, the phone system and file storage. For each one, ask how long it can be unavailable before the consequence becomes serious rather than annoying, and what happens if its data is exposed or altered. Owners usually know these answers but have never written them down.

Then trace what each system depends on. Billing depends on the practice management system, which depends on the internet connection, which may depend on a single router in a closet. Sort the results into three tiers: critical, important and deferrable. If everything is critical, nothing has been ranked.

Step 2: Inventory systems, data and access

Record the devices, servers, cloud services and applications in use, where sensitive data lives and who has access to it. Pay special attention to administrator accounts, shared logins, former employees and vendors with remote access. Gaps in this inventory are themselves a finding, because unknown systems are rarely protected well.

Step 3: List realistic threats

Focus on the threats that commonly affect businesses like yours rather than every possibility. For most small and midsize businesses, the list includes:

• Phishing that steals passwords.
• Account takeover of email or cloud applications.
• Ransomware that encrypts systems and data.
• Payment fraud through fake invoices or changed banking details.
• Hardware failure or accidental deletion without a working backup.
• Compromise through a vendor or software supplier.

Step 4: Record the controls already in place

For each critical system and threat, note what already reduces the risk: multi-factor authentication, endpoint protection, email filtering, backups, training and monitoring. Be honest about how well each control works, and mark each one effective, partial or absent. Multi-factor authentication on email means little if several accounts are exempt, and a backup that has never been restored is not yet a proven control. Partial controls deserve the closest look, because they create confidence without full coverage.

Step 5: Score likelihood and impact

Use a simple scale from one to five for each risk:

• Likelihood: one means unlikely given current controls, and five means expected without changes.
• Impact: one means a minor inconvenience, and five means the business stops or suffers serious financial, legal or reputational harm.

Multiply the two to rank risks. The scores do not need to be precise. They need to be consistent, so that the team agrees one risk is clearly more urgent than another. Judge impact in business terms, such as lost revenue, missed deliveries or regulatory exposure, rather than technical severity.

Step 6: Build a risk register and decide treatment

Put each risk on one line with its score, an owner and a review date. Then decide how to treat it:

• Reduce it with a new or improved control.
• Transfer part of it, for example through cyber insurance or a contract.
• Accept it, with leadership signing off and a date to revisit.
• Avoid it by stopping the activity that creates it.

The owner should be a person rather than a department, and the review date should be specific. The register becomes the plan and the record of what leadership knew and decided. Review it regularly and whenever the business changes significantly.

Self-assessment, professional assessment or penetration test

A self-assessment using this method is a good starting point and helps leadership understand the issues. A professional assessment adds technical review of configurations, evidence and gaps that are hard to see from the inside, and returns a prioritized remediation plan. A penetration test goes further by having specialists actively try to break in, which is most useful once basic controls are in place.

Inzo's cybersecurity risk assessment page lays out the assessment process, how to prepare and what the report includes. For a fast first look, try our cyber risk checklist or book an Insight Session.

Frequently asked questions

How often should a business assess cyber risk?

Rebuild the full assessment at least once a year and review the register more often. Repeat it after significant changes such as an acquisition, a new location, a major new system, a change in IT staff or a security incident.

Who should be involved in a cyber risk assessment?

Include leadership, the people who run finance and operations, whoever manages IT and any key software vendors. Business leaders judge impact, finance understands payment fraud exposure and technical staff judge likelihood and controls. An assessment done only by technical staff tends to rank by technical severity, which is the problem it was meant to solve.

What should a cyber risk assessment report include?

Expect a leadership summary, the critical systems reviewed, findings tied to evidence, a ranked list of risks with recommended treatments and owners, and the decisions leadership needs to make.

Is a cyber risk assessment required for cyber insurance?

Requirements vary by insurer. Many applications ask about specific controls, and a recent assessment makes those questions easier to answer accurately.