A cyber security risk is the possibility of something going wrong with your accounts, devices, systems, information or suppliers and causing a business impact. Risk assessment helps directors decide what needs fixing first and who is responsible. It does not require complicated software or pages of unowned spreadsheets.
Threat, vulnerability and business impact
A threat is a potential cause of harm, such as credential theft, ransomware, accidental deletion or a supplier outage. A vulnerability is a weakness that could allow the threat to succeed, such as an unsupported computer, shared administrator password or untested backup. The business impact may be lost revenue, delayed customer service, fraud, contractual problems or data exposure.
A simple five-step cyber risk assessment
- Identify assets: list the accounts and systems needed to serve customers and get paid.
- Describe scenarios: state a realistic event, such as a finance mailbox being compromised.
- Rate likelihood and impact: use a consistent low, medium or high scale.
- Choose treatment: reduce, avoid, transfer or explicitly accept residual risk.
- Assign owner and review date: record who is accountable and when evidence will be checked.
Worked example: supplier payment fraud
A finance employee receives an apparent supplier email requesting a change of bank details. The impact could be a substantial fraudulent payment. Useful treatments include independent callback verification, approval separation, security awareness, domain/email authentication and account MFA. The owner is the finance director, supported by IT and the finance team.
Worked example: ransomware and recovery
A staff device is infected and important files become unavailable. Controls include patching, endpoint monitoring, access restrictions and isolated backup copies. The owner should know the recovery time objective and when the last restoration test passed, rather than accepting “we have backups” as proof.
What should the risk register contain?
Keep a short record of the risk scenario, affected system, consequence, likelihood, impact, existing controls, additional action, deadline, owner and residual risk. Review after material changes such as a new cloud application, acquisition, office move or serious security incident.
Frequently asked questions
Is a vulnerability scan the same as a risk assessment?
No. Scans identify certain technical weaknesses. Risk assessment adds business context, impact, decision-making and ownership.
How often should risk be reviewed?
Review regularly and when business systems, suppliers or threats materially change. The right interval reflects the organisation’s exposure.
Can a small business use a simple spreadsheet?
Yes. A short, maintained risk register with accountable owners is often more useful than a complex document nobody uses.
Get practical help from 39Security
39Security offers security reviews and managed control improvements for UK SMEs that want clear risk prioritisation and practical ownership.