A cyber security risk assessment is the process of finding the threats and weaknesses that could harm your systems and data. It sizes each risk and ranks them so that leadership can decide what to do. This guide gives the IT risk assessment steps in order, and each has one owner role and one named output. It is for IT heads, IT managers and business owners at firms of roughly 250 to 2,000 people in India and the GCC, where one person holds several jobs. In those firms a board, an auditor or a customer may ask to see the security assessment process done.
What a Cyber Security Risk Assessment Is, and What It Is Not
NIST’s Guide for Conducting Risk Assessments (SP 800-30 Revision 1, September 2012) defines risk assessment as “the process of identifying, estimating, and prioritizing information security risks”. It describes risk as “typically a function of” the adverse impact if an event happens and the likelihood that it happens. The result is a list in rank order, so whoever gets the question “how exposed are we?” has something to show. To see which places that exposure sits in for a growing firm, read where risk hides in a growing business.
It is not a vulnerability scan or a penetration test. A scan or a test supplies facts about weaknesses for Step 4. The cyber security risk assessment weighs those facts against the business. The penetration testing entry explains the test.
Two further published guides sit behind this article, but each has a different reader in mind. CISA’s SAFECOM guide to getting started (2022) targets public safety organisations. CERT-In’s 15 Elemental Cyber Defense Controls for MSMEs (version 1.0, 1 September 2025) is a reference list written for MSMEs. The seven steps below follow our own ordering of their shared logic. Treat them as Signisys’ adaptation for a mid-size firm and not as a standard.
Last reviewed 2026-11-01 by Manish Sharma.
Key Takeaway A risk assessment finds threats and weaknesses, scores each risk in defined words, and ends in a ranked register that leadership acts on.
How to Run a Cyber Security Risk Assessment in Seven Steps
The seven steps of the cyber security risk assessment run in the order below. Each one has a section further down.
Write down what the assessment is for and what it covers, before anyone scores a risk.
List what the business depends on, so each critical system has a named owner.
Write each threat as a source and an event, such as a former employee misusing an account.
Find the gaps a threat could use, and map each one to an asset when you can.
Rate likelihood and impact in defined words, because a reason beside each score lets others check it.
Put the risks in order, and choose a response if a risk sits above the line.
Update the register when something changes, such as a new system or supplier.
Who Owns Each Step and What It Produces
The IT risk assessment steps below each have one owner role and one output, and the table is the map. The step order, the owner roles and the scoring grid are Signisys suggestions.
Owner roles suit a firm with one IT head, so one person can hold several roles. What matters is that you write down each role, even when one person fills several.
| Step | Owner (suggested) | Output |
|---|---|---|
| 1. Purpose and scope | The IT head runs it, and one leader sponsors it so findings have somewhere to go | If the brief is missing, the rest drifts, so this step ends in a one-page assessment brief |
| 2. Assets | The IT head, with a business owner named for each critical system | When the list exists, later steps have something to attach to, which makes it the asset list |
| 3. Threats | The IT head, with whoever runs the security tools | As a result of this step, a threat list names the source and the event on each line |
| 4. Weaknesses | The IT head and each system owner, plus an outside tester where one is used | For example, a weakness list maps each gap to an asset |
| 5. Score | The IT head with the business owner | Because each score carries a reason, the output is a scored risk list |
| 6. Rank and decide | The sponsor decides, and the IT head presents | In the end, a ranked risk register gets a response, an owner and a date on each line |
| 7. Review | The IT head | When something changes, an updated register records the date and a short change log |
How the Steps Map to NIST’s Four Phases
NIST splits the work into four steps, which are prepare, conduct, communicate and maintain, and Signisys maps the seven steps onto them. In that mapping, Steps 1 and 2 prepare, Steps 3 to 5 conduct, Step 6 communicates and Step 7 maintains.
Step 1: Set the Purpose and Scope of the Cyber Security Risk Assessment
Step 1 sets down what the risk assessment is for and what it covers. NIST SP 800-30 asks for the purpose, meaning the information the assessment should produce and the decisions it supports (Task 1-1). It also asks for the scope “in terms of organizational applicability, time frame supported, and architectural/technology considerations” (Task 1-2). A limited scope is therefore a legitimate choice, and a first assessment can cover one business unit, one site or one process.
Also record the assumptions and the information sources. Fix the scale before any scoring, because CISA’s guide asks what “high”, “medium” and “low” mean, and whether “risk” and “threat” are defined precisely and consistently. CISA’s guide targets public safety organisations, but the prompts apply to any firm.
Owner: the IT head runs it, and one member of the leadership team sponsors it. Output: a one-page assessment brief covering purpose, scope, assumptions, sources and the scale.
Step 2: List the Assets and Name a Business Owner for Each
The asset list is the second step of the risk assessment. It comes before anyone lists a threat. An asset is anything the business depends on, such as systems, data, devices and the accounts that reach them. NIST SP 800-30 has no asset-inventory task of its own; Task 1-4 asks for the sources of descriptive, threat, vulnerability and impact information. The inventory comes from CERT-In control 1, which asks for a “centralized, continuously updated inventory of all hardware, software, and information assets”, with sensitive assets labelled and the lifecycle tracked to secure disposal.
CISA’s Step One also adds interfaces and vendor access. List each supplier, the data it holds and the systems it can reach, as covered in our guide to third-party risk. The attack surface entry also explains why each reachable asset counts. CERT-In’s document targets MSMEs, so for a larger firm it is a reference and not a rule.
Owner: the IT head, with a named business owner for each critical system. Output: an asset list with an owner beside each critical system.
Step 3: Identify the Threats
A threat is a circumstance or event with the potential to adversely impact operations and assets, in NIST’s wording. NIST SP 800-30 asks for the threat sources of concern (Task 2-1), and for the threat events and which sources could start them (Task 2-2). Threats also come from inside, and CISA’s Step Three names administrative privileges, reliance on a managed service provider and a supply chain software vendor’s tools as examples.
For outside sources, the CISA Known Exploited Vulnerabilities catalog lists flaws that attackers are already using, and the threat intelligence entry explains the wider idea. In this step of the risk assessment, write each threat as a source and an event. A former employee misusing a retained account is one example.
Owner: the IT head, with whoever runs the security tools or the managed provider’s contact. Output: a threat list, with the source and the event on each line.
Step 4: Find the Weaknesses
NIST defines a vulnerability, which this guide calls a weakness, as a weakness in an information system, in system security procedures, in internal controls or in implementation that a threat source could exploit. NIST SP 800-30 also asks for predisposing conditions, meaning conditions that affect the likelihood of harm (Task 2-3). Scan results, a configuration review and an access review all feed this step of the risk assessment.
CERT-In control 15 (VAA.1) asks MSMEs for independent third-party vulnerability assessments of business-critical assets “at least once a year”. That figure applies to those vulnerability assessments, as well as to the baseline audit in the document’s utilization section. It is not a figure for a cyber security risk assessment.
A scan lists weaknesses, while the assessment decides which ones matter to the business.
Owner: the IT head and the owner of each system, with an outside tester if the firm uses one. Output: a weakness list mapped to the asset list, one line per asset and weakness.
Step 5: Score Likelihood and Impact
The scoring step of a risk assessment rates each threat and weakness pair (Tasks 2-4 to 2-6). It rates the likelihood that the pair causes harm and the impact if it does. NIST describes three approaches, which are quantitative, qualitative and semi-quantitative. For a first assessment, Signisys suggests words rather than numbers. NIST notes that qualitative assessments “typically employ” non-numerical levels such as low, moderate and high.
Define each level, because NIST warns that without clear definitions or meaningful examples, different experts could produce significantly different results. It adds that repeatability improves when each value is annotated with a reason, so write one beside every score. The system owner helps judge likelihood, and the business owner judges impact, since they are closest to what a loss would mean for the work.
Owner: the IT head with the business owner. Output: a scored risk list, which is the draft of the register.
Step 6: Rank the Risks and Decide the Response
NIST’s third step is to communicate results to decision makers (Tasks 3-1 and 3-2). It lists executive briefings, risk assessment reports and dashboards as ways to do it. NIST’s Appendix K gives, as an example only, the elements of an executive summary: the date, purpose, scope, initial or later assessment, overall level of risk, and the number of risks at each level. Our view of the audience is in what directors need to see.
The ranking step of the risk assessment ends with leadership picking a response for each risk above the line. NIST SP 800-39 lists acceptance, avoidance, mitigation, sharing, transfer, or a combination. We say accept, avoid, reduce, share and transfer, but NIST calls the third one mitigation.
Owner: the sponsor decides, and the IT head presents. Output: a ranked risk register with a response, an owner and a date on each line, plus a one-page summary for leadership.
Step 7: Review and Refresh the Cyber Security Risk Assessment
NIST states that “the validity and usefulness of any risk assessment is bounded in time”. It adds that monitoring risk factors can be used “to refresh risk assessments at whatever frequency deemed appropriate”, so NIST sets no interval. CERT-In control 15 (VAA.2) lists this recommendation: “Perform periodic risk assessments to identify organization-specific threats and guide mitigation strategies.” It gives no interval either. CISA’s guide says an assessment is not meant to be conducted just once.
Signisys suggests that the final step of the risk assessment ties a review to changes in your own firm, such as a new system or a new supplier. Those triggers are our examples and not NIST text.
Owner: the IT head. Output: an updated register with a review date and a short change log.
Key Takeaway Each step ends in one named output, and the last output is a register that leadership acts on and reviews.
A Worked Row: Scoring One Risk
This worked row for a cyber security risk assessment is an illustration with no client and no numbers. It uses a simple three-level scale that Signisys suggests, but it is not one from NIST. You may change the grid as long as the words stay defined.
| Likelihood | Low impact | Medium impact | High impact |
|---|---|---|---|
| Low | If both are low, the rating is low | When impact is medium, the rating is low | If impact is high, the rating is medium |
| Medium | If impact is low, the rating is low | Because both are middling, the rating is medium | If impact is high, the rating is high |
| High | If impact is low, the rating is medium | When impact is medium, the rating is high | If both are high, the rating is high |
The register row below scores one risk, and a reason sits beside each value.
| Field | Entry |
|---|---|
| Risk | A former employee misuses a retained account to read files |
| Asset | The shared drive that holds HR and payroll files |
| Weakness | Accounts of people who have left are still active |
| Threat | Misuse of that access by someone who no longer works there, an internal-source threat in CISA’s sense |
| Likelihood | Medium, because the account list is not reviewed on a set date |
| Impact | High, because personal data of staff would be exposed |
| Rating | High, because the grid above gives high for that pair |
| Response | Reduce, by disabling leavers’ accounts when people leave and reviewing the list on a set date |
| Owner | The HR head for the leavers list, while the IT head disables the accounts |
| Due date and status | Left blank here, to fill in when the response is agreed |
A value with a reason can be checked and repeated by someone else.
Start Your First Cyber Security Risk Assessment Small
Pick one unit, one site or one process and finish it, then widen. NIST puts scope in the preparation step, so a limited scope is part of the method. Findings with no owner and no date count as unfinished work, so end the pass with the register and the owners named.
A firm with regulated data, or a customer asking for evidence, may need an external assessor for Step 4. CERT-In control 15 also asks for independent third-party vulnerability assessments of business-critical assets. A cyber security risk assessment is easier to finish when the scope is small, and it can grow after leadership has used the register at a meeting.
Signisys provides security risk assessment and cybersecurity services, and we can talk through the scope and the owners for your firm before you start. The assess and reduce cybersecurity risks page also shows the wider use case.
Check the current NIST, CISA and CERT-In pages before you rely on a quoted line, as of November 2026.
What This Article Does Not Cover
This guide leaves out a list of checks to tick off, a comparison of frameworks, how to carry out the fixes, tools, GCC regulation and any UAE or Saudi rule. No primary source for them was read here. India’s incident-reporting directions are also outside it.
Get specialist help in these cases.
- A business-critical system the team is not set up to test itself.
- Regulated or customer-critical data.
- An audit or customer questionnaire that asks for evidence.
- No one who can be named as owner.
Cyber Security Risk Assessment FAQ
What are the steps of a risk assessment?
How is a risk assessment different from a vulnerability scan or a penetration test?
Who should run a risk assessment when the firm has no security team?
How do you score likelihood and impact in words?
How long does a cyber security risk assessment stay valid?
Does CERT-In require a risk assessment?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.