A cyber security risk assessment helps you decide what could go wrong, how it would affect your business and what deserves attention first. The useful result is a set of decisions with named owners, rather than a spreadsheet full of unexplained scores.
You can start with one important activity, such as paying suppliers or delivering customer orders. Bring together someone who understands that work and someone who understands the systems behind it. An IT provider may know your settings, but they won't necessarily know what a missed delivery means for your biggest customer.
Start with the work you need to protect
Write down the activity, where it starts and ends, and what you're leaving out. Then list what it relies on.
For supplier payments, that could include the finance staff, their laptops, the accounts mailbox, accounting software, banking access and the procedure for changing bank details. A cloud provider or outsourced bookkeeper belongs on the list even though you don't control their systems.
Record who owns each part and where responsibilities change hands. The NCSC's guidance on scope and assets explains why dependencies and connections matter alongside devices and software.
Keep the boundary honest. Assessing supplier payments doesn't tell you whether your warehouse can recover from an outage.
Describe an event, not just a worrying word
“Ransomware”, “phishing” and “data loss” are useful topics, but they're too broad to make a decision about on their own.
Try this structure:
Someone or something could exploit this weakness, affecting this activity and causing this harm.
For example, a criminal could send a convincing bank-detail change to the accounts mailbox. If staff approve changes using only the email, the next supplier payment could go to the criminal.
You can also consider accidental deletion, inappropriate access and supplier disruption. Choose plausible scenarios for the activity you've defined. If you think something is unlikely, explain why and record the evidence or assumptions behind that judgement.
Check what already reduces the risk
Ask for something you can verify. “We use MFA” is less useful than a dated check showing which relevant accounts require it. “We have backups” leaves open whether the information you need is included and can be restored.
For a payment process, inspect the written approval steps and ask how they work when the usual approver is away. Use a fictional example to discuss the process without sending money or changing a real supplier record.
The NCSC calls the work of building confidence in controls assurance. A policy, a configured setting and evidence that people follow the process tell you different things. Note gaps as unknowns rather than assuming everything works.
Weigh likelihood and impact in business terms
Pick a time period, such as the coming year, so everyone is discussing the same question. Explain what makes the scenario more or less likely, including exposure, known weaknesses and controls you have checked.
Then describe the consequences. Could it delay wages, expose customer information, interrupt a critical service or leave you unable to pay a supplier? Include harm to people where relevant. Use credible ranges for costs or downtime where you have evidence, and label estimates clearly.
You can use low, medium and high if your team agrees what they mean. Don't invent precise probabilities from a guess. The NCSC's introductory assessment method warns that poorly explained matrices and ratings can miscommunicate risk.
A fictional example
Imagine Rowan Print, a fictional eight-person business reviewing supplier payments over the next 12 months.
Its finance assistant receives invoices by email. The owner approves payment amounts, but neither person independently verifies changed bank details. The accountant confirms that some monthly supplier payments are larger than the firm's spare cash buffer.
The team records a credible payment-diversion scenario. It cannot justify a percentage probability. The existing amount approval would not reliably catch a substituted account number, and the financial consequence could stop it buying materials. That combination makes the gap a priority.
The owner agrees that changes will require a callback using independently held contact details and a second person's approval. The finance assistant owns the procedure update, due before the next payment run. A fictional change request will be used to check the process, including holiday cover.
After that check, the owner reviews the remaining risk of convincing impersonation or someone bypassing the procedure. Any decision to accept it is dated, explained and given a review date. These are example decisions, not universal deadlines or a guarantee against fraud.
Keep a record you can act on
NIST's small business guide recommends documenting threats and responses in a risk register. This simple record is a starting point you can copy for each scenario:
Risk ID and assessment date:
Activity and assessment boundaries:
Assets, people and supplier dependencies:
Scenario and weakness:
Existing controls and dated evidence:
Likelihood over a stated period, with reasons:
Business impact and assumptions:
Information still needed:
Priority and reason:
Decision and planned action:
Action owner and due date:
How completion and effectiveness will be checked:
Remaining risk after verified changes:
Person accepting that risk, date and reason:
Next review date and earlier review triggers:
Keep access to the register limited to people who need it. It may describe sensitive weaknesses. Link to evidence in its approved location rather than copying passwords, customer records or recovery codes into it.
Turn the assessment into decisions
Compare the scenarios and choose proportionate responses. You might improve a control, stop a risky activity or accept a remaining risk with a clear reason. Insurance may address some financial consequences, but it doesn't restore customer trust or remove every responsibility.
The NCSC's risk management guidance stresses understanding what remains after controls are applied. Don't lower a rating just because a fix is planned. Check that it's working first.
Agree a review date and revisit the assessment sooner after a significant system change, supplier change or incident. The review should also catch overdue actions and assumptions that turned out to be wrong.
Know what this assessment doesn't replace
A vulnerability scan automatically checks for certain security weaknesses. A penetration test uses authorised attempts to breach agreed systems. Both can inform an assessment, but neither decides which business consequences you can tolerate.
Cyber Essentials provides a baseline against common internet threats. Its certification doesn't establish that every risk specific to your business has been assessed. This worksheet doesn't provide certification or demonstrate compliance with every legal, regulatory or contractual obligation either.
For complex systems, safety consequences or unclear obligations, get suitable specialist help. For a straightforward starting point, take your highest-priority action and put it into your ongoing cyber security routine, with an owner who can show when it's done.