A simple risk assessment for a small business, in one afternoon

Risk assessment sounds like paperwork for big companies, but the idea is simple: find what could hurt the business most, and fix those things first. A small office can do a useful first version in an afternoon.

1. List what matters

Write down the assets the business can't work without: customer data, the accounting system, email, the internet connection, laptops, the file server. Next to each, note who owns it.

2. List what could go wrong

For each asset, think of threats: ransomware, a stolen laptop, a failed disk, a phishing email, a power cut, a staff mistake. The note on threats, vulnerabilities and risk explains the vocabulary.

3. Score each risk

Give each one a likelihood (1 to 5) and an impact (1 to 5), and multiply them. A ransomware attack on unbacked-up files might score 4 × 5 = 20; a broken printer 3 × 1 = 3. Sort the list, highest first.

4. Decide what to do

• Reduce the big ones: backups that are tested, MFA, patching, a firewall.
• Share some: cyber insurance or a managed IT provider.
• Accept the small ones, knowingly.
• Avoid anything not worth the risk, such as an old system nobody uses.

5. Write it down and review it

Turn the decisions into a short security policy (see security policies and ISO/IEC 27002) and review the list every six months, or after any incident. If you handle personal data in the UK, also check your duties in UK computer law.

The first version doesn't have to be perfect. A short list that you act on is worth far more than a long report that sits in a drawer.