A cyber security risk assessment is a structured review that identifies what your business needs to protect, what could go wrong, and how bad each scenario would be — producing a prioritised list of risks with fixes attached. It is the planning exercise that decides where security money and time go first. This guide explains the process in plain terms and how a small business runs one in 2026.
TL;DR
- A risk assessment answers three questions: what do we hold that is valuable, how could it be compromised, and how bad would each outcome be.
- Output is a ranked risk register — not a pass/fail grade — with owners and actions attached.
- Small business version: one structured afternoon, reviewed quarterly, beats an annual auditor visit.
- The top risks for most small businesses are people-related: phishing, invoice fraud and compromised credentials.
What is a cyber security risk assessment?
The process has five steps. Identify assets: what data, systems and services would hurt most to lose — client records, finance systems, email, your ability to trade. Identify threats: how each could be compromised — phishing, ransomware, invoice fraud, a lost laptop, a departing employee. Assess likelihood and impact: for each pairing, how plausible and how expensive. Treat the risk: fix it, reduce it, transfer it (insurance), or accept it knowingly. Review: risks move, so the assessment is repeated — quarterly for small business.
A risk assessment is broader than a technical check. A cyber security gap assessment measures your controls against a framework; a risk assessment weighs business consequences. Most small businesses need both, in that order: gaps first, risks ranked second.
The risks that dominate small business registers
- Phishing and credential theft — triggered by one staff member on a fake login page; leads to account takeover and further attacks from inside.
- Invoice and payment fraud — triggered by a lookalike vendor email changing bank details; direct financial loss, often unrecoverable.
- Ransomware — triggered by an unpatched system or phished credential; trading halted, data encrypted, recovery costs.
- Data breach — triggered by exposed records or a compromised account; notification duties and client trust damage.
- Insider risk — triggered by departing staff or careless access; data loss and competitive damage.
Notice the pattern: three of the five start with a person, not a machine. That is why the treatment list for most small businesses leads with security awareness training, MFA and payment verification processes before it reaches firewalls or monitoring.
Running a risk assessment in one afternoon
- List what you would rebuild first if everything were lost tomorrow — that list is your critical assets.
- For each asset, name the two or three ways it realistically fails — use the list above as a starting pattern.
- Score each scenario for likelihood (unlikely / possible / likely) and impact (annoying / expensive / business-stopping).
- Act on the top-right corner of that grid — likely and business-stopping gets fixed first, and each action gets an owner and a date.
- Record the accepted risks. A consciously accepted risk with a note is defensible; an unnoticed one is not.
- Revisit quarterly. New staff, new systems and new threats move the grid.
FAQ
What is a cyber security risk assessment? A structured review that identifies your critical assets, the ways each could be compromised, and a prioritised list of risks with treatments and owners.
How often should a small business do one? At least annually as a full review, with the top risks revisited quarterly.
Is a risk assessment the same as a gap assessment? No. A gap assessment compares your controls with a standard; a risk assessment weighs business consequences and likelihood. They feed each other.
Do we need a consultant for a risk assessment? No — a small business can run a credible one in-house in an afternoon using a structured template. External help adds value for regulated industries or after an incident.
What is risk treatment? The decision for each identified risk: reduce it with controls, transfer it (usually insurance), avoid it by changing a process, or accept it with eyes open.
Does cyber insurance require a risk assessment? Insurers increasingly ask about your security posture at application and claim time; a documented assessment is the evidence.
One last thing
Write down your single biggest cyber risk right now, from memory, in one sentence. Then compare it with the list you build properly — the gap between what you fear and what the structure reveals is usually where the real exposure sits.
Related guides
- What is a cyber security gap assessment? — the controls-first sibling of this exercise.
- What is phishing? — the risk that tops most small business registers.
- What is invoice fraud? — the payment risk most assessments underweight.
- What is an incident response plan? — what you need once risks are named.
- Compare security awareness platforms