Cyber Security Risk Assessments

How the assessment runs

Agree scope and risk criteria; identify critical information and dependencies; review existing controls and available evidence; assess plausible impact and likelihood with stated assumptions; prioritise treatment; present decisions and accountable next steps.

Deliverables

Findings can feed ISO 27001 work, insurance questionnaires, supplier assurance and co-managed remediation. The assessment alone does not meet a regulator's or insurer's requirements.

• Scoped findings and evidence limitations.
• A risk register or agreed assessment output.
• A plain-language leadership summary.
• A prioritised remediation roadmap and owners.
• Recommendations for further assurance where needed.
• A decision log for matters requiring authorised client approval.

Scoping around the business, not just the network

We start with what the organisation depends on: the systems that stop work if they fail, the information that would cause harm if exposed, and the obligations you carry to clients and regulators.

• Critical business processes and the systems behind them
• Sensitive or regulated information, and where it lives
• Contractual, insurer and regulatory obligations
• Suppliers and third parties with access to your data or systems
• Recovery expectations, and whether they are realistic today

Assessing exposure and existing controls

The technical review covers the areas where incidents actually begin, and takes account of the controls you already have rather than assessing against a blank page.

• Identity and access, including administrative accounts and MFA coverage
• Email security, phishing exposure and user awareness
• Endpoints, patching, malware protection and device management
• Cloud services, tenant configuration and data sharing
• Network, remote access and infrastructure exposure
• Backup, recovery and incident-response readiness

Rating, ownership and the treatment plan

Risks are rated on likelihood and business impact, so the conversation is about consequences rather than technical severity scores. Each risk gets a named owner and a recommended treatment: reduce, transfer, avoid or accept.

The output is deliberately usable by non-technical leadership, because that is who has to fund and prioritise the work.

• Risk register with likelihood, impact, owner and treatment
• Board-ready summary in plain language
• Prioritised remediation roadmap with quick wins identified
• Input to insurance, supplier questionnaires and certification work
• Follow-up review to track progress and reassess