The cybersecurity risk assessment: a step by step guide for small businesses

Most small businesses know they should "do something about cybersecurity." The hard part is knowing what to do first. A risk assessment answers that question. It is a structured look at what you have, what could go wrong, how bad it would be, and which fixes matter most.

You don't need a large budget or a security team to do a useful one. Here are the eight steps, the frameworks that help, and when it makes sense to bring in an outside assessor.

Step 1: Set the scope

Decide what the assessment covers. For most small businesses that means the whole organization: every office, every remote worker, and every cloud service you pay for. Write down who owns the assessment and when it should be finished. A loose scope is how assessments drag on for months.

Step 2: Inventory systems, data and vendors

List what you have before you judge it:

• Devices: computers, servers, phones, tablets, printers, firewalls and WiFi equipment.
• Accounts and services: email, file sharing, accounting, payroll, banking portals, and any line of business software.
• Data: where customer, employee and financial information is stored, and who can reach it.
• Vendors: anyone with remote access or a copy of your data, including your IT provider.

Expect surprises. Most inventories turn up shadow IT, such as a file sharing account a department set up on its own, or a vendor connection nobody remembers approving.

Step 3: Identify the threats that apply to you

Keep this practical. For most small businesses the threats that cause real damage are a short list: phishing and stolen passwords, business email compromise and wire fraud, ransomware, a lost or stolen laptop, a careless or departing employee, a vendor that gets breached, and plain hardware failure or human error.

Step 4: Check the controls you already have

For each threat, ask what is in place today, and whether you can prove it:

• MFA on email, remote access, banking and admin accounts.
• EDR or a current endpoint protection product on every computer and server.
• Backups that are copied offsite, isolated from the network, and restored on a test basis.
• Patching on a schedule, and no systems running software that no longer gets security updates.
• Email filtering and a way for staff to report suspicious messages.
• Separate admin accounts, used only for admin work.
• Security awareness training that staff actually complete.
• A written plan for what happens if something goes wrong.

"I think so" counts as no. If nobody can show you the setting or the report, treat the control as missing.

Step 5: Rate likelihood and impact

For each threat, rate how likely it is and how much it would hurt, using a simple low, medium and high scale. Impact should include downtime, lost money, legal and notification costs, and damage to customer trust. A missing MFA setting on email is usually high likelihood and high impact. An old printer on the guest network is usually low on both.

Step 6: Build a simple risk register

Put the results in one table or spreadsheet with a row per risk: the threat, the asset it affects, the current controls, the likelihood and impact ratings, the planned fix, an owner and a due date. This is the document an insurer, auditor or new IT provider will want to see, and it keeps the work from living in one person's head.

Step 7: Make a prioritized plan

Sort the register so the high likelihood, high impact items come first. Fixes that are cheap and fast, such as turning on MFA or removing old accounts, should happen right away even if they rank lower. Larger projects go into a schedule with real dates and budgets. Our guide to building an IT and security roadmap shows how to turn the register into a plan leadership can fund.

A risk assessment is not a report you file. It is the list you work from.

Step 8: Review on a schedule

Every assessment is a snapshot. Repeat it every year, and again after a major change: a new office, a new core system, a merger, or a security incident. Update the register as fixes are completed so you can see progress.

Frameworks that make this easier

• NIST Cybersecurity Framework 2.0 organizes security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is a good structure for the whole program.
• CIS Controls, Implementation Group 1 is a short, prioritized list of safeguards written for smaller organizations. It is a practical checklist for Step 4.
• Industry rules may require a written assessment. Under the FTC Safeguards Rule, covered businesses such as auto dealers, mortgage brokers and tax preparers must base their security program on a written risk assessment. Healthcare practices need a HIPAA security risk analysis, which our HIPAA risk analysis guide covers.

Doing it yourself vs bringing in an assessor

A motivated office manager or owner can complete a first pass with the steps above. An outside assessment adds three things: someone who knows what to look for in your settings and logs, independence when a regulator, insurer or bank examiner asks who checked, and testing that confirms controls work instead of taking them on faith. Our article on cybersecurity costs and ROI covers how to weigh that spend.

Where to start

Block two hours this week and complete Steps 1 and 2. The inventory alone will tell you a lot. If you would rather have it done for you, our cybersecurity audit names the framework you are held to, the gaps that matter most, and what each one costs to fix.