Cybersecurity · Risk assessment
List what you would hate to lose, how it could go, what is in place, score it simply, and fix the top five. Template and worked example included.
Eight to fifteen rows is plenty
Score likelihood and impact 1 to 3
Unknown counts as missing
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time on the calendar below. Or call 954-539-5678.
A cybersecurity risk assessment for a small, non-regulated business can fit on one page. List the things you would hate to lose, how each could realistically be lost, what you already have in place, a simple rating of how likely and how bad it would be, and then fix the top five. Repeat once a year, or when something big changes. It is the template I would hand a 20- or 50-person company that has never done one.
My firm opinion: a one-page assessment you act on beats a 60-page framework you file. I have seen plenty of thick risk registers, often produced for an insurance renewal or a large client’s vendor questionnaire, that nobody opened again. The fact remains that the value of a risk assessment is in the five things you change afterwards. Everything else is paperwork.
One caveat. If you handle health information, card payments, defense contracts or financial customer data, you have specific requirements (HIPAA’s security risk analysis, PCI DSS, CMMC, the FTC Safeguards Rule), and a one-pager is a starting point, not the whole job. We cover the healthcare version in our HIPAA security risk assessment guide.
The premise of a formal risk assessment, as NIST describes it in Special Publication 800-30, is sound: identify threats, vulnerabilities, likelihood and impact, and use that to decide where to spend. It is a careful, thorough method, and for a hospital or a bank it is the right one.
The problem, in a 25-person company, is that nobody has three weeks to spend on it. The owner starts, gets stuck on the difference between a threat source and a threat event, and the spreadsheet goes into a folder. Meanwhile the shared admin password is still on a sticky note. So I would rather you do the short version properly than the long version halfway. If you later want more structure, the NIST Cybersecurity Framework for small business is the natural next step.
Make a table with these columns. A spreadsheet is fine. So is a sheet of paper.
Three points on scoring. Use 1 to 3 rather than 1 to 5, because small teams argue endlessly about the difference between a 3 and a 4. Score what is true today, before any planned fixes. And if nobody knows whether a control is in place, write “unknown” and score it as if it were missing. Unknown is a finding.
Here is an illustrative version for a 20-person engineering firm that uses Microsoft 365, keeps project files in SharePoint, runs payroll through an online provider and has one on-site file server with old archives. These are its six highest-scoring rows.
The top five actions here would take a competent person a couple of weeks, cost relatively little, and remove most of the realistic risk. That is what a useful assessment looks like. Not one of them needed a consultant to discover. They needed someone to sit down for two hours and write it down.
If you would rather have someone else do the data collection, our free Technology Health Assessment covers the same ground (security, backups, applications and more) in 30 minutes of data collection, with a plain-language report the next day rating each area as controlled, needs attention, significant exposure or unknown. The report is yours to keep, no obligation. Book your free assessment.
Once the scores are in, sort the table and take the top five rows. For each one write a single next action, a name and a date. Then do them before you add anything else to the list.
In my experience the top five almost always include some of the same items: MFA gaps, admin accounts nobody reviewed, backups that have never been restored, payment fraud with no call-back rule, and laptops without encryption. CISA’s Cyber Essentials and our own small business cybersecurity checklist are useful for checking that you have not missed an obvious row.
When the five are done, rescore them. A row that drops from 9 to 3 is the proof that the exercise was worth doing. Put the date on the sheet and set a reminder for next year, or for the next time something changes: a new office, a new system, an acquisition, a merger, a security incident.
The owner or general manager, with whoever handles IT and whoever handles money in the same room. The owner knows what would hurt. The IT person knows what is really in place. The finance person knows how payments actually move, which is where a lot of small-business losses happen. In a small firm, two hours around one table is usually enough.
If you want the formal version later, for a client questionnaire or an insurer, a good one-pager makes it far easier. Our Technology Health Assessment is a reasonable place to start either way.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Once a year, and again whenever something significant changes: a new system, a new office, an acquisition, or a security incident. The rescoring after you fix the top five is the most useful part.
No. Regulated data comes with specific requirements, such as HIPAA’s security risk analysis. A one-pager is a good start, but confirm what your regulator, auditor or insurer expects.
The owner or manager, with whoever runs IT and whoever handles payments. An outside IT provider can do the data collection, but the business has to decide what it would hate to lose.
A scan looks for technical weaknesses in systems. A risk assessment asks what matters to the business, how it could be lost, and what to fix first. A scan can be one input into the assessment.
