Risk assessment

Also known as: risk analysis

Working out what could go wrong, how likely it is and how much harm it would do, so the biggest risks get handled first.

Draft - this entry has not been reviewed yet.

How to put it into practice

The usual steps, in order. Adapt them to your organisation.

Define scope and criteria first - which processes and systems are covered, the likelihood and consequence scales, and the level at which risk is acceptable.
List the critical assets (processes, information, systems, suppliers) with their owners, working from an up-to-date system overview.
For each asset, identify relevant threats and vulnerabilities, using threat and vulnerability catalogues and the current SAMSIK threat assessment as input.
Describe each risk as a scenario with a business consequence, for example customer data leaked after phishing, not just as a system name.
Rate likelihood and consequence for each scenario on the agreed scales, taking existing controls into account; the SAMSIK risk assessment template is a free starting point.
Evaluate the results against the acceptance criteria and rank the risks that need treatment.
Document the assessment, have the risk owners sign it off and present the top risks to management.
Repeat the assessment at planned intervals and when significant changes occur (ISO 27001 clause 8.2), and keep earlier versions for comparison.

Common pitfalls

Scoring risks without agreed criteria, so the same risk gets different ratings from different people.
Treating a vulnerability scan or a DPIA as the risk assessment instead of as inputs to it.
Rating on gut feeling alone, without using incident history or threat intelligence.
Doing it once for certification and never updating it when systems or threats change.

Good guides

NIST SP 800-30 Rev. 1 - Guide for Conducting Risk Assessments(opens in a new tab) · NIST
NIS2 Technical Implementation Guidance(opens in a new tab) · ENISA
Vejledning i risikostyring inden for informationssikkerhed (2025)(opens in a new tab) · Styrelsen for Samfundssikkerhed (in Danish)
Introduktion til risikostyring(opens in a new tab) · Styrelsen for Samfundssikkerhed (in Danish)

Technical deep dive

In ISO terminology risk assessment is the umbrella for three sub-steps: risk identification, risk analysis and risk evaluation (ISO 31000:2018 clauses 6.4.2 to 6.4.4; ISO/IEC 27005:2022 clauses 7.2 to 7.4). Analysis determines likelihood and consequence and thereby the level of risk; evaluation compares that level with the risk criteria to decide which risks need treatment and in what order. Using "risk analysis" as a synonym for the whole activity, as is common in everyday usage, blurs the distinction, and in Danish practice risikovurdering and risikoanalyse are likewise used loosely.

ISO/IEC 27001:2022 separates defining the process from running it. Clause 6.1.2 requires a defined assessment process with established acceptance criteria and criteria for performing assessments, producing consistent, valid and comparable results, identifying risks to confidentiality, integrity and availability within scope, assigning risk owners, and analysing and evaluating those risks. Clause 8.2 then requires assessments to be performed at planned intervals or when significant changes are proposed or occur, with the results retained as documented information. ISO/IEC 27005:2022 describes two identification approaches: an event-based approach working from risk sources and strategic scenarios, and an asset-based approach enumerating assets, threats and vulnerabilities in detail. It also replaced the older term incident scenario with risk scenario.

NIST SP 800-30 Rev. 1 structures assessment as prepare, conduct, communicate and maintain, and places it on the three tiers defined in SP 800-39: organisation, mission or business process, and information system. Its risk model links threat sources, threat events, vulnerabilities and predisposing conditions, likelihood and impact, with example scales in Appendices D to I. The method can be qualitative, semi-quantitative or quantitative; the choice affects precision and cost but not the underlying structure.

Neighbouring activities differ in object and output. A vulnerability assessment lists concrete technical weaknesses but does not by itself rate business risk; threat modelling analyses a design for what could go wrong, typically at development time; a business impact analysis measures impact over time without considering likelihood; and a GDPR data protection impact assessment under Art. 35 rates risk to the rights and freedoms of data subjects rather than to the organisation. A risk assessment consumes all four as inputs. Typical failures are scoring without agreed criteria, registers describing systems instead of business consequences, and one-off assessments never repeated when the environment changes.

What to learn first

Everything this builds on, foundations first.

CIA triad
→Threat
→Asset
→Vulnerability
→Impact
→Likelihood
→Risk
→Risk assessment

Relationships

Sources & further reading

Standards & official texts

NIST SP 800-30 Rev. 1 - Guide for Conducting Risk Assessments · NIST
ISO/IEC 27005:2022 - Guidance on managing information security risks · ISO/IEC

Course material

Cyber Security Fast Track - Ordliste

Where this data comes from

This entry was drafted by an AI from the sources above and has not yet been checked by a person. Treat it as a starting point, and check anything important against the sources.

See the review queue Suggest a correction on GitHub This term as JSON

Mentioned in

AI governance Shadow AI Compliance roadmap Information security management system (ISMS)ISO 27001 Log retention Management responsibility NIS2 Directive NIS2 minimum requirements

Check yourself

Loading…