What an IT Risk Assessment Checklist Is, and How to Read This One
An IT risk assessment checklist is a list of checks you tick off to show you assessed risk properly. It also confirms that the controls you expect are in place. It works as a security risk assessment checklist for leaders who must show an auditor, insurer or customer the checks made. This page gives 30 checks, each with an owner, the evidence to collect and a pass test.
Last reviewed 2026-11-01 by Manish Sharma.
The checks come from two documents. Part 1 follows the 15 tasks in NIST SP 800-30 Rev. 1, the Guide for Conducting Risk Assessments (September 2012), which NIST wrote for the US federal setting. Part 2 follows the 15 control areas in CERT-In’s 15 Elemental Cyber Defense Controls for MSMEs (version 1.0, 1 September 2025). CERT-In wrote them for MSMEs, so a larger firm can read them as a reference list.
The owner roles, the evidence and the pass tests are Signisys wording, not NIST’s or CERT-In’s, and neither document defines the Pass, Partial and Fail marks used here.
A risk assessment weighs the risks to your information and systems and ranks them. A vulnerability assessment is different: it is one input to a risk assessment. If you want to know what the risk itself is, read our cyber risk explainer.
How to Mark Each Row
Every table has the same four columns, and the check says what to confirm. The owner is a role, but one person can hold several. The evidence is what you can show someone else, while the pass test is the single condition that earns a Pass.
Mark each row Pass when it meets the test and the evidence is on file. Partial means the work exists but the evidence is thin or the test is part-met. Fail means the work is missing. The tables are in the page, so you can copy the rows into your own sheet. This page reflects both documents as of November 2026.
If you copy this security risk assessment checklist into a sheet, add columns for the mark, the date and notes. Then each Partial and Fail has a place to wait for its decision.
IT Risk Assessment Checklist Part 1: Was the Assessment Done Properly?
Part 1 has 15 checks, one for each NIST task, grouped in NIST’s four steps: prepare, conduct, communicate and maintain.
A fail here can mean your risk scores are not yet reliable, but not that the firm is unsafe.
Checks 1 to 5: Prepare the Assessment
These five checks cover what the assessment is for and how it will judge risk, before anyone collects a fact.
| Check | Owner | Evidence | Pass test |
|---|---|---|---|
| 1) Purpose: the assessment’s purpose and the decision it supports are written down (NIST task 1-1). | Sponsor | A one-page brief that names the decision. | If a person outside IT can state the decision in one sentence, it passes. |
| 2) Scope: systems, sites, business units and time frame covered are listed, with exclusions (task 1-2). | IT head | A scope list approved by the sponsor. | When every business-critical system is in scope or on the exclusion list with a reason, it passes. |
| 3) Assumptions and constraints: conditions such as time, staff and untested systems are written down (task 1-3). | IT head | A list of assumptions, each marked checked or unchecked. | If the untested assumptions are named and a reader can challenge each one, it passes. |
| 4) Information sources: where facts on assets, threats, weaknesses and impact come from are named (task 1-4). | IT head | For example, the asset export, scan reports and the incident log. | If each score in the risk list traces to a named source, it passes. |
| 5) Risk model and approach: how risk is judged is chosen, with each level defined in words (task 1-5). | IT head, sponsor | Scale definitions with one example per level. | If two people score one sample risk and reach the same level, it passes. |
Checks 6 to 8: Find the Threats and Weaknesses
In an IT risk assessment checklist, these three checks cover who or what could cause harm, as well as the weaknesses that make harm more likely.
| Check | Owner | Evidence | Pass test |
|---|---|---|---|
| 6) Threat sources: attackers and non-adversarial sources such as mistakes and outages are listed (task 2-1). | IT head | A threat-source list written for this firm. | If it names non-adversarial sources as well as attackers, it passes. |
| 7) Threat events: possible events are listed, each with its source and how relevant it is (task 2-2). | IT head | An event list, each line marked relevant or not. | When every event carries a reason for keeping or dropping it, it passes. |
| 8) Weaknesses and conditions: weaknesses that make an event more likely to cause harm are listed (task 2-3). | IT head | Scan reports and review notes, used as inputs. | If each weakness ties to a system and an event, it passes. |
Checks 9 to 11: Rate and Rank the Risks
NIST SP 800-30 Rev. 1 section 2.3 warns that unclear levels can give different experts different results, while a reason beside each rating increases repeatability.
| Check | Owner | Evidence | Pass test |
|---|---|---|---|
| 9) Likelihood: the chance that each event leads to harm is rated, with a reason beside the rating (task 2-4; the reason beside the rating follows NIST section 2.3). | IT head | A likelihood level and a one-line reason for each risk. | If every level has a written reason, it passes. |
| 10) Impact: the harm to operations, assets, people and other organisations is rated (task 2-5). | Business owner | An impact level for each risk, confirmed by the system’s business owner. | When the person who bears the loss confirms each level in writing, it passes. |
| 11) Risk: likelihood and impact combine into a level, and the risks are ranked (task 2-6). | IT head | The ranked risk list. | If each risk appears once, has a level from the defined scale and sits in rank order, it passes. |
Checks 12 to 15: Share the Results and Keep Them Current
NIST says an assessment’s validity has a limit in time and sets no interval. Monitoring can refresh it “at whatever frequency deemed appropriate”, so this page names none.
| Check | Owner | Evidence | Pass test |
|---|---|---|---|
| 12) Communicate: results go to the people who decide what to do (task 3-1). | Sponsor | A briefing, report or dashboard, which NIST gives as examples, with a recorded decision per top risk. | If leadership has seen the ranked list, it passes. |
| 13) Share: risk information reaches the staff who own affected systems (task 3-2). | IT head | A record of who received which part. | When each system owner has received the lines for their systems, it passes. |
| 14) Monitor: someone watches the factors that change risk, such as new systems, new suppliers and incidents (task 4-1). | IT head | A named watcher and a short list of change triggers. | If the trigger list covers new systems and new suppliers, it passes. |
| 15) Update: the assessment is revised when monitoring shows a change (task 4-2). | IT head | A dated revision note saying what changed. | If the document shows a last-updated date and the reason for the latest change, it passes. |
Key Takeaway In this security risk assessment checklist, Part 1 asks whether you can trust the scores, and Part 2 asks whether the controls exist.
IT Risk Assessment Checklist Part 2: Which Controls Should You Find?
Part 2 has 15 checks, one for each CERT-In control area, in three tables. They are the controls a security risk assessment checklist should find in place, or find missing. CERT-In calls them a minimum baseline for MSMEs, but its Disclaimer tells MSMEs to go beyond them based on their own risk assessments.
Checks 16 to 20: Assets, Devices and Patching
These five checks cover what you own, how you configure it, and whether it is up to date.
| Check | Owner | Evidence | Pass test |
|---|---|---|---|
| 16) Area 1, asset management: one current inventory of hardware, software and information assets, sensitive ones labelled, each tracked through its life (EAM.1, EAM.2). | IT head | The inventory export, showing owner, label and status. | If a random sample of assets from the floor and the cloud all appear in it, it passes. |
| 17) Area 2, network and email security: firewalls, a VPN with multi-factor sign-in for remote access, and SPF, DKIM and DMARC for email. | IT head | VPN settings and DNS email records. | If remote access asks for multi-factor sign-in and the records are published, it passes. |
| 18) Area 3, endpoint and mobile security: endpoint protection is installed on all devices, software installs are limited to authorised staff and removable media is controlled. | IT head | An endpoint coverage report and the install-rights list. | When every managed device reports protection on, it passes. |
| 19) Area 4, secure configurations: systems follow an approved baseline, with unused features and default passwords removed. | IT head | The baseline document and a sample comparison. | If a sample of servers matches the baseline and none uses a default password, it passes. |
| 20) Area 5, patch management: security updates are applied across systems, applications and firmware, and advisories are watched. | IT head | A patch status report. | If the firm’s own written time limit for critical updates is met or each exception is listed, it passes. |
Checks 21 to 25: Access, People and Suppliers
These IT risk assessment checklist rows cover who gets in, whether multi-factor sign-in is on, and who supplies you. Our guide to third-party risk goes deeper on suppliers.
| Check | Owner | Evidence | Pass test |
|---|---|---|---|
| 21) Area 12, password policy: strong unique passwords and lockout are set, and multi-factor sign-in covers critical systems, administrator accounts and remote access. | IT head | Password and lockout settings, and the multi-factor enrolment report. | If every administrator account and remote-access route is enrolled, it passes. |
| 22) Area 13, access control and identity: least-privilege roles (ACIM.2), reviewed at least quarterly under CERT-In’s MSME baseline and at each exit (ACIM.3). | IT head, HR head | The latest access review and the offboarding checklist. | When no sampled leaver has a live account, it passes. |
| 23) Area 8, awareness and training: staff and contractors are trained at least twice a year under CERT-In’s MSME baseline (AT.1). | HR head | Attendance records and the training outline. | If everyone on the HR list attended the latest session or a make-up, it passes. |
| 24) Area 9, third-party risk: each supplier has had due diligence matched to its business impact or likelihood of compromise. | Vendor owner | A supplier register with a tier and a due-diligence record. | If every supplier with system or data access has a completed record, it passes. |
| 25) Area 14, physical security: access to server rooms and network equipment is controlled, and an asset-return list is used at every exit. | Facilities head | The server-room access list and sample exit checklists. | When the access list matches current staff, it passes. |
Checks 26 to 30: Detection, Recovery and Oversight
These checks cover spotting a problem, responding to an incident, restoring data and independent proof.
| Check | Owner | Evidence | Pass test |
|---|---|---|---|
| 26) Area 7, logging and monitoring: systems log activity, logs are kept securely, and privileged actions are watched (LM.1, LM.2). | IT head | Log settings and one alert review. | If a sample system meets the firm’s written retention period, it passes. |
| 27) Area 6, incident management: a written plan covers reporting, containment, investigation, recovery and communication, is tested, and follows CERT-In’s reporting directions. | IT head | The plan and its last test record. | When the plan names who reports to CERT-In and the test record is dated, it passes. |
| 28) Area 10, data protection, backup and recovery: scheduled backups, offsite and offline copies, tested restores and a continuity plan. | IT head | The backup schedule and a restore-test record. | If a critical system was restored and the record shows date and result, it passes. |
| 29) Area 11, governance and compliance: one person leads information security, and an approved, reviewed policy follows CERT-In and regulator directions. | Sponsor | The approved policy and the named contact. | When the policy carries approval and review dates and names a contact, it passes. |
| 30) Area 15, vulnerability audits and assessments: business-critical assets get an independent assessment at least once a year under CERT-In’s MSME baseline (VAA.1). | IT head, sponsor | The latest independent report and remediation list. | If each finding has an owner and a due date, it passes. |
Signisys provides security risk assessment and cybersecurity services for growing firms. A conversation can help you collect the evidence, check your marks and weigh each gap. The decisions stay with your own team.
What to Do With Each Pass, Partial and Fail
Every Partial and Fail from a security risk assessment checklist becomes a line in your risk list, with an owner and a decision. If a Pass has no evidence on file, it counts as a Partial.
NIST SP 800-39 (March 2011) lists acceptance, avoidance, mitigation, sharing and transfer, or a combination, as responses to a risk. In plain words, you accept, avoid, reduce, share or transfer it, and NIST calls reducing a risk mitigation. When you choose one, record it and who owns it.
You fix a Part 1 fail in the assessment, before you use its scores. You fix a Part 2 fail in the system, and you mark the row again when new evidence is on file. If you want the steps in order, read how to run the steps of a risk assessment.
Key Takeaway Mark a row Pass only when the evidence is on file. A Pass with nothing to show is a Partial.
What This IT Risk Assessment Checklist Does Not Cover
This page does not cover the ordered process or a comparison of frameworks. It also leaves out ISO 27001, CIS Controls, Zero Trust design, cloud security posture tools and AI agent governance. A security risk assessment checklist for a building, with doors and cameras, is outside it too. If you need cloud controls, see our cloud security checklist for CISOs. GCC rules are also outside this page. If you want the wider topic, see the use case on how to assess and reduce cybersecurity risks. For the network controls, see our 20-check audit of an office network.
CERT-In wrote its baseline for MSMEs, and this page does not say which legal duties apply to your firm. The page is not legal advice on reporting duties, and it does not show how to carry out the fixes.
Get specialist help when your firm holds regulated or customer-critical data, before an audit or a customer questionnaire that asks for evidence, or when a Fail has no owner.
Signisys provides cybersecurity services, including risk assessment support for growing firms. The cybersecurity services page lists what Signisys offers, while the decisions on each gap stay with your own team.
IT Risk Assessment Checklist FAQ
What should an IT risk assessment checklist include?
Who should fill in the checklist when there is no risk team?
What do Pass, Partial and Fail mean?
Do the CERT-In controls apply to a firm that is not an MSME?
Is an IT risk assessment checklist different from a security audit or a vulnerability scan?
Is there an IT risk assessment checklist in Excel or PDF?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.