A cybersecurity risk assessment maps critical business services and their dependencies, writes each risk as a threat, weakness and consequence scenario, and scores likelihood and impact on calibrated scales. Each top risk then receives a treatment, an owner and a review date, often structured with NIST CSF 2.0 or ISO/IEC 27005.
Rating forty risks as high is not a decision. A useful assessment tells leadership what to fund, what to accept and who owns it.
A city fire service does not place the same equipment outside every building. It maps where fires are likely, what would be lost and how fast crews can respond, then places stations accordingly. This guide gives you a six-step process, calibrated scales and a worked loss calculation. Your next cybersecurity risk assessment can then end in decisions rather than a document.
What a cybersecurity risk assessment should produce
A cybersecurity risk assessment identifies the threats and weaknesses that could harm critical business services. It estimates how likely and how damaging each scenario is, then ranks them so leadership can choose a response. NIST's Cybersecurity Framework 2.0 (CSF 2.0) places this work under its Identify function.
Judge an assessment by its outputs, not its length. A useful one yields a short ranked list of scenarios in business language and a treatment and owner for each. It also records accepted risks with expiry dates and fits on one page for the board.
Most assessments fail because they describe rather than decide. They rate asset lists instead of services, and use labels such as 'ransomware' instead of scenarios. Their scales also mean different things to finance and engineering. IBM's 2025 research put the global average cost of a data breach at USD 4.44 million, so an assessment that does not steer budget is expensive.
The six-step process
- Set the appetite: agree testable limits first, such as no critical service down for more than eight hours.
- Map critical services: list the five to fifteen that earn revenue or meet regulatory duties, with their systems, data and suppliers.
- Write scenarios: a threat exploits a weakness in a dependency, causing a consequence to a service.
- Score on calibrated scales: define every level in money and hours before the workshop.
- Decide a treatment: reduce, transfer, accept with a signed expiry date, or avoid.
- Report and maintain: give leadership one page, then re-score after any material change.
Suppliers belong in step two, not in a separate exercise. NIST CSF 2.0 expects critical suppliers to be assessed before acquisition. A single payment or identity provider can halt several services at once.
A well-formed scenario reads as follows. 'A criminal group uses stolen credentials against remote access without phishing-resistant multi-factor authentication (MFA). It encrypts the order system and halts fulfilment for three to five days.' Each part points to a control you could change.
| Level | Likelihood per year | Financial impact | Service disruption |
|---|---|---|---|
| 1 Rare | Under 5% | Below 0.1% of revenue | Under 1 hour |
| 2 Unlikely | 5–20% | 0.1–0.5% of revenue | Up to 8 hours |
| 3 Possible | 20–50% | 0.5–2% of revenue | Up to 3 days |
| 4 Likely | 50–80% | 2–5% of revenue | Up to 2 weeks |
| 5 Almost certain | Over 80% | Above 5% of revenue | Over 2 weeks or loss of licence |
Score impact on the worst credible outcome, not the worst imaginable one. Anchor likelihood in your incident history, test findings and sector threat intelligence. Where estimates differ widely, record the range rather than forcing agreement.
Worked example: testing whether a control pays
Take the ransomware scenario above for a hypothetical company with USD 50 million in annual revenue. Impact, if it occurs, is estimated at USD 2 million. A control combining phishing-resistant MFA and tested offline backups costs USD 120,000 a year. It cuts likelihood from 20% to 8%.
Expected annual loss is likelihood multiplied by impact. It falls from USD 400,000 to USD 160,000, a reduction of USD 240,000. Net of the control's cost, that is a 100% return.
The same arithmetic shows when not to spend. A control that costs more each year than the loss it removes is better replaced by insurance or a signed acceptance. Leadership should see the ranges behind every estimate, because a stated estimate can be challenged and improved.
Choosing a framework, and why it matters now
Frameworks give consistency; they do not do the thinking. We recommend one as the spine, borrowing techniques from others.
| Framework | What it offers | Best fit |
|---|---|---|
| NIST CSF 2.0 (February 2024) | Six functions, with risk assessment under Identify | A common language for boards and regulators |
| ISO/IEC 27005:2022 | Guidance on assessing and treating information security risk | Organisations running an ISO/IEC 27001 management system |
| NIST SP 800-30 Rev. 1 | A detailed method for conducting risk assessments | Teams needing rigour in the assessment step |
Leadership accountability is now explicit. The SEC's 2023 rules require US-listed companies to describe how they assess material cybersecurity risks. They must also disclose material incidents, generally within four business days of determining materiality. In India, CERT-In directions issued in April 2022 require specified incidents to be reported within six hours of noticing them.
The bottom line
Conclusion
A fire service that protects every building equally protects none of them well. A useful risk assessment maps critical services, writes risks as scenarios, scores them in money and hours, and ends with a treatment and an owner for each risk that matters.
This week, rewrite your current top five risks as single scenario sentences, each with a cause, a weakness and a consequence for a named service. A risk that cannot be written that way is not yet ready to be scored.
Frequently asked questions
What are the steps of a cybersecurity risk assessment?
Set the risk appetite, map critical services and dependencies, write risk scenarios, score them on calibrated scales, decide a treatment for each, then report to leadership and keep the register current.
What is the difference between NIST CSF 2.0 and ISO/IEC 27005?
NIST CSF 2.0 organises cybersecurity outcomes into six functions and gives leadership a shared language. ISO/IEC 27005:2022 gives detailed risk management guidance within an ISO/IEC 27001 management system.
How do I calculate cyber risk in money?
Multiply a scenario's estimated annual likelihood by its estimated impact to get expected annual loss. Then compare the loss a control removes with the control's annual cost.
Should suppliers be part of a cybersecurity risk assessment?
Yes. Map the suppliers each critical service depends on and feed third-party assessment results into the scenarios, because many outages and breaches run through a provider.
How often should a cyber risk assessment be updated?
Review it at least yearly, and re-score affected risks after material change such as a new product, an acquisition, a cloud migration, a significant incident or a new critical supplier.
References
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29 (26 February 2024)
- IBM, Cost of a Data Breach Report 2025: AI findings
- ISO, ISO/IEC 27005:2022 Guidance on managing information security risks (October 2022)
- NIST, SP 800-30 Rev. 1 Guide for Conducting Risk Assessments (September 2012)
- US SEC, SEC adopts rules on cybersecurity risk management, strategy, governance and incident disclosure (26 July 2023)
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (28 April 2022)
- ISO, ISO/IEC 27001 Information security management
Disclaimer: General information only, not legal, security, compliance or financial advice. Check the cited sources and seek professional advice. Names belong to their owners; no endorsement implied.