How to perform a cybersecurity risk assessment in 5 steps

A cybersecurity risk assessment is a structured review that finds where your business is exposed, how likely each threat is, and what it would cost, so you can fix the biggest risks first instead of guessing. Here is how to run one in five practical steps.

Step 1: Inventory what you are protecting

You cannot protect what you have not listed. Catalog your systems, applications, and data, and note where sensitive information lives, customer records, financials, health or payment data. This inventory is the map every later step works from.

Step 2: Identify the threats and vulnerabilities

For each asset, ask what could go wrong, ransomware, phishing, a lost laptop, an unpatched server, a weak password, and where the weaknesses actually are. Be honest about the gaps; the point is to surface them now rather than during a breach.

Step 3: Assess likelihood and impact

Rank each risk by how likely it is and how badly it would hurt the business. NIST's risk assessment guidance offers a simple model: a high-likelihood, high-impact risk is an emergency, while a rare, low-impact one can wait. This is what turns a long list into priorities.

Step 4: Prioritize and plan remediation

Sort by risk and tackle the worst first. A handful of high-impact fixes, multi-factor authentication, tested backups, patching, and email security, the basics CISA recommends, remove most of the risk most businesses carry. Assign an owner and a date to each.

Step 5: Review regularly

Risk is not static: new threats appear, you add systems, and people change. Reassess at least once a year and after any major change. If running this in-house is too much, a vCISO can own the whole process, and a quick security self-assessment is a fast way to get started.