Cyber Security Risk Assessment: Steps and Frameworks

A cyber security risk assessment is a structured review that scores each threat to your systems and data by how likely it is and how much damage it would cause, so you know which risks to fix first. The result is a ranked list that connects technical weaknesses, such as unpatched software or shared admin passwords, to their cost for the business.

NIST describes risk as “typically a function of” the adverse impact of an event and the likelihood it occurs. Pentestica runs risk and maturity assessments as part of its cybersecurity consulting.

Core steps in a cyber security risk assessment

1. Define scope and objectives: Set the boundaries of the assessment, name the stakeholders and list the critical systems and data you’ll evaluate.
2. Identify assets: Catalog hardware, software, cloud services, data, the people who run them and the vendors that hold your data, then rank them by how much the business depends on each one.
3. Identify threats and vulnerabilities: Note who could attack you and how, along with technical weaknesses such as unpatched software, weak or reused credentials and permissions that are wider than they need to be.
4. Analyze and calculate risk: For each scenario, estimate the likelihood that a threat exploits a weakness and the financial, operational or reputational impact if it does. Rating both on the same simple scale, such as low, medium and high, lets you plot every scenario on one risk matrix.
5. Prioritize and mitigate: Decide how to respond to each risk. NIST lists the options as “accepting, avoiding, mitigating, sharing, or transferring risk”. Mitigation usually means controls like MFA, segmentation or encryption.
6. Monitor and document: Record the decisions, owners and deadlines, and repeat the assessment when your systems, vendors or threats change.

Popular frameworks for a cyber security risk assessment

• NIST SP 800-30 and SP 800-39: NIST SP 800-30 Rev. 1 is a “Guide for Conducting Risk Assessments”, and NIST SP 800-39 places assessment inside an organization-wide program for managing information security risk.
• ISO/IEC 27001: If your organization runs an information security management system under this standard, use the same risk method and scales in your assessment so the results feed straight into it.
• MITRE ATT&CK: A globally accessible knowledge base of adversary tactics and techniques. MITRE ATT&CK helps turn “who could attack us” into concrete attack scenarios you can score.

If a standard or regulation such as PCI DSS, HIPAA or DORA drives the assessment, see what each one expects in our guide to penetration testing requirements.

Where a penetration test fits in a risk assessment

A risk assessment estimates likelihood and impact. A penetration test shows whether an attack path actually exists, which is often what moves a risk up or down the list. A scan can miss this because it reports weaknesses one system at a time (see penetration testing vs vulnerability scanning); a tester checks how they connect.

In internal network tests, we’ve found this pattern: one workstation had a local administrator account configured identically to several other computers. After gaining access to the first device, the tester showed that access could be extended to further hosts. An automated tool saw each system separately, but only analyzing the dependencies showed the scale of the problem. The client deployed unique local administrator passwords.

Pentestica’s team has run 500+ penetration tests. A cyber security risk or maturity assessment is quoted individually, in tester-days after a scoping call, with a fixed price for the agreed scope confirmed in writing before work starts. Where the assessment points to a technical risk, an internal penetration test can confirm it, and a retest is available after fixes. For ongoing ownership of the security roadmap, see what a vCISO does, or browse all our penetration testing services.

Sources: NIST CSRC Glossary: risk; NIST CSRC Glossary: risk response; NIST SP 800-30 Rev. 1; NIST SP 800-39; MITRE ATT&CK.