What a Cyber Risk Assessment Should Include

“Risk assessment” gets used for almost anything in this industry. A free scan with a sales call at the end gets called one. So does a six-week project that ends in a binder. If you are a Columbus business owner trying to buy one, or a customer or insurer has asked whether you’ve had one, it helps to know what the term should mean and what you should get back.

What a risk assessment is

NIST, the federal standards agency, describes risk as a combination of two things: how likely something bad is to happen, and how much harm it would do if it did. A risk assessment works through both for your business, and it ends in decisions about what to fix first.

That is different from the things it often gets confused with:

• A vulnerability scan finds known weaknesses, like missing patches or exposed services. It is an input to a risk assessment, not the assessment itself.
• A penetration test has someone actively try to break in, to prove which weaknesses can really be used.
• A compliance gap assessment checks you against a specific standard, such as SOC 2, CMMC or HIPAA, and lists what is missing.

A real risk assessment draws on all of those, then asks the business question underneath: of everything that could go wrong, which few things would hurt most, and what do we do about them?

What it should look at

For a small or mid-sized business, an assessment that skips any of these is leaving something out:

• Accounts and sign-in. Is multi-factor authentication enforced, and what is on the exception list? How many administrator accounts exist, and who uses them? Are staff passwords showing up in known breach data?
• Devices. Are laptops and servers patched? Is endpoint protection on every device, counted against a real inventory rather than a license count?
• Email and Microsoft 365. Mail forwarding rules, sharing settings, which outside apps have been granted access, and whether your domain is protected against spoofing.
• Your data. Where sensitive information lives, including the places nobody planned on, like a scanner’s email folder or an old file share.
• Backups. Whether they exist, whether an attacker could delete them, and when someone last restored from one.
• Your edge. The firewall, remote access, and anything reachable from the internet.
• Vendors. Which outside companies can reach your systems or your data, and what their contracts say.
• People and process. How accounts are removed when someone leaves, whether there is an incident response plan, and whether staff have had security training.

The technical checks are the easy part to buy. The last two bullets are where most assessments get thin, and they are often where the real problem is.

What you should get back

An assessment is only as useful as the report you can act on. A good one gives you:

• A scope statement that says what was checked and, just as important, what was not.
• Findings ranked by risk, each explained in plain language: what is wrong, why it matters to this business, and how likely it is to be used.
• A fix list in priority order, with a rough sense of effort, so you can do the most important things first.
• A short summary a non-technical owner or board can read in five minutes.
• A conversation where someone walks you through the findings and answers questions.

A few things should make you skeptical. An eighty-page export of raw scan output is not an assessment. Neither is a report where every item is marked critical, because then nothing is. And if the report has no scope statement, you can’t tell a clean result from an area nobody checked.

Free assessments, and what they cost you

Many IT providers offer a free assessment. Some are useful. Usually, though, it is part of a sales process: the company scoping the work is the same one that would sell you the fix, and the assessment usually ends in a proposal. That doesn’t make the findings wrong. It does mean you should read them knowing who wrote them.

There is one free option with no sales pitch attached. CISA, the federal cybersecurity agency, offers free vulnerability scanning to government and critical infrastructure organizations. If you qualify, it’s worth having. It only looks from the outside, though, so it covers one item on the list above, not the whole thing.

How often to do one

At least once a year, and again after anything big changes: a new office, a merger, a move to new software, a security incident. Some rules build this in, including the FTC Safeguards Rule for tax preparers and HIPAA for medical practices. Cyber insurance renewals also ask about many of the same controls every year, so a recent assessment makes those forms easier to answer honestly.

The first assessment is the hard one. After that, it becomes a check on whether last year’s fixes happened.

Where our Security Analysis fits

We built our Security Analysis to be a useful first look without the sales pitch. It costs $349 and covers sign-ins and credentials, your devices, your cloud and email, and your external perimeter. You don’t hand over any admin passwords, and nothing gets installed on your systems. Our team reviews every finding before you see it, then walks you through the results live. The team that runs it doesn’t also sell you the fixes.

It’s a snapshot of where you stand today. It doesn’t replace a penetration test, and on its own it isn’t the formal risk analysis a rule like HIPAA requires, though it gives you a solid technical starting point for one.

If you’d rather start with a conversation, tell us what’s prompting the question: a customer questionnaire, an insurance renewal, or just a sense that nobody has looked in a while. Our vulnerability assessments and virtual CISO service cover the deeper versions.

Sources

• NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments
• NIST Cybersecurity Framework 2.0
• CISA Cyber Hygiene Services