How to Conduct a Cybersecurity Risk Assessment

Every UK business faces cyber risk. Whether you are a five-person accounting firm in Manchester or a 200-person manufacturing company in Birmingham, your business holds data, depends on technology, and is a potential target for cybercriminals. The question is not whether you face risk — it is whether you understand what that risk looks like, how severe it is, and what you are doing to manage it.

A cybersecurity risk assessment is the formal process of identifying, analysing, and evaluating the cyber risks your business faces. It provides the foundation for every security decision you make — from which controls to implement and how much to spend on security, to which risks to accept and which to prioritise for immediate action. Without a risk assessment, your security spending is essentially guesswork: you might be investing heavily in protecting against unlikely threats while leaving your most significant vulnerabilities completely unaddressed.

This guide provides a practical, step-by-step methodology for conducting a cybersecurity risk assessment suitable for UK SMEs. It aligns with the guidance published by the National Cyber Security Centre (NCSC), supports Cyber Essentials and Cyber Essentials Plus certification, and satisfies the risk assessment requirements of UK GDPR Article 32.

What Is a Cybersecurity Risk Assessment?

A cybersecurity risk assessment is a structured process for identifying and evaluating the risks that cyber threats pose to your business. It answers three fundamental questions: what could go wrong (threat identification), how likely is it to happen (likelihood assessment), and how bad would it be if it did happen (impact assessment). The combination of likelihood and impact gives you the overall risk level for each identified threat, which then guides your decisions about how to respond.

Risk assessments are not a one-off exercise. The threat landscape changes continuously, your business evolves, and new technologies introduce new vulnerabilities. Best practice is to conduct a comprehensive risk assessment annually and to review and update it whenever significant changes occur — such as adopting a new cloud platform, opening a new office, or experiencing a security incident.

Step 1: Identify Your Assets

The first step is to catalogue what you need to protect. In cybersecurity, an asset is anything that has value to your organisation and could be targeted, compromised, or lost. For most UK SMEs, the key asset categories include customer personal data (names, contact details, payment information), financial records and banking credentials, intellectual property and trade secrets, employee data (HR records, payroll information), IT systems and infrastructure (servers, workstations, network equipment), cloud services and accounts (Microsoft 365, CRM, accounting software), physical premises and equipment, and your business reputation.

For each asset, record its location (on-premises, cloud, or both), who has access to it, and how critical it is to your business operations. This inventory becomes the foundation for the rest of the assessment.

Categorising Asset Criticality

Not all assets carry equal weight. A methodical approach to categorising asset criticality helps you focus your assessment on the areas that matter most to your business continuity. Consider classifying assets into three tiers: mission-critical assets without which your business cannot operate for more than a few hours (such as your primary line-of-business application, email system, or customer database), important assets whose loss would cause significant disruption within 24 to 48 hours (such as financial reporting systems, HR platforms, or secondary communication channels), and supporting assets whose temporary unavailability would be inconvenient but manageable (such as internal wikis, non-essential productivity tools, or archived records).

This tiered classification directly influences how you score the impact of threats later in the process. A ransomware attack affecting a mission-critical asset warrants a significantly higher impact score than the same attack targeting a supporting asset. It also helps you communicate priorities to senior management — when resources are limited, as they inevitably are in SME environments, the tiered model provides a clear rationale for directing protection efforts towards the assets that matter most.

Step 2: Identify Threats and Vulnerabilities

With your asset inventory complete, identify the threats that could affect each asset and the vulnerabilities that those threats could exploit.

Common Threats for UK SMEs

The NCSC identifies several threat categories that are particularly relevant to UK businesses. Phishing and social engineering remain the most common attack vector, accounting for the majority of successful breaches. Ransomware encrypts your data and demands payment for its return. Credential theft — through phishing, brute force attacks, or credential stuffing using stolen password databases — gives attackers access to your systems and data. Insider threats, whether malicious or accidental, account for a significant proportion of data breaches. Supply chain attacks target your business through vulnerabilities in your suppliers, partners, or software providers.

Common Vulnerabilities

Vulnerabilities are the weaknesses that threats exploit. Common vulnerabilities in UK SME environments include unpatched software and operating systems, weak or reused passwords without multi-factor authentication, lack of staff security awareness training, inadequate backup systems or untested recovery procedures, excessive user privileges (staff having access to more data and systems than their role requires), unsecured remote access (particularly RDP exposed to the internet), and outdated or end-of-life hardware and software.

Conducting a Practical Vulnerability Assessment

Identifying vulnerabilities requires both technical and procedural investigation. On the technical side, vulnerability scanning tools can identify known security flaws in your software, operating systems, and network configuration. Many of these tools are available at low cost or are included with managed IT services. However, technical scanning alone is insufficient — some of the most significant vulnerabilities are procedural rather than technical. Does your organisation have a clear process for revoking access when an employee leaves? Are passwords shared between team members for convenience? Do staff members use personal devices to access company data without any mobile device management in place?

A thorough vulnerability assessment should include a review of your network architecture and configuration, an examination of your access control policies and practices, an assessment of your physical security arrangements, an evaluation of your data handling and storage procedures, and a review of your third-party supplier relationships and the access they have to your systems. Walk through your business processes and ask at each stage: what could go wrong here, and what safeguards are in place to prevent it? The answers — and particularly the gaps — form the basis of your vulnerability inventory.

For businesses pursuing Cyber Essentials certification, the vulnerability identification process maps closely to the scheme's five technical control areas: firewalls and internet gateways, secure configuration, user access control, malware protection, and security update management. Assessing your current posture against these five areas provides a structured and practical starting point for vulnerability identification.

Step 3: Analyse and Evaluate Risks

For each combination of threat and vulnerability, assess both the likelihood of the threat materialising and the impact it would have on your business. Use a consistent scoring scale for both dimensions.

Score	Likelihood	Impact
1 - Very Low	Unlikely to occur in the next 3 years	Minor inconvenience, no financial or data loss
2 - Low	Could occur once in the next 3 years	Limited disruption, under £5,000 cost
3 - Medium	Likely to occur once per year	Significant disruption, £5,000–£50,000 cost
4 - High	Likely to occur multiple times per year	Major disruption, £50,000–£250,000 cost, potential regulatory action
5 - Very High	Almost certain to occur	Catastrophic, £250,000+ cost, serious regulatory penalties, business survival at risk

Multiply the likelihood score by the impact score to get an overall risk score for each identified risk. This gives you a range from 1 (very low risk) to 25 (critical risk). Risks scoring 15 or above require immediate attention. Risks scoring 8 to 14 should be addressed within the next quarter. Risks scoring below 8 should be monitored and reviewed periodically.

Qualitative and Quantitative Approaches

The scoring methodology described above is a qualitative approach — it uses descriptive categories and professional judgement rather than precise numerical data. This is the most practical method for the majority of UK SMEs because it does not require extensive historical data on incident frequency or detailed financial modelling of potential losses. However, it is worth understanding that quantitative methods also exist, and larger organisations may benefit from combining both approaches.

A quantitative risk assessment attempts to assign specific monetary values to both the likelihood of incidents and their potential impact. For example, rather than scoring a phishing risk as likelihood 4 and impact 3, a quantitative assessment might estimate that phishing attacks are expected to succeed 2.5 times per year with an average cost of £18,000 per incident, giving an annualised loss expectancy of £45,000. This approach is powerful for making cost-benefit arguments for security investment, but it requires reliable data that most SMEs simply do not have.

For most UK small and medium-sized businesses, the qualitative approach provides sufficient rigour to guide decision-making. The important thing is consistency — use the same scoring methodology across all risks so that the relative prioritisation is meaningful, even if the individual scores are somewhat subjective. The goal is not mathematical certainty — it is informed, defensible decision-making about where to focus your security resources.

Step 4: Determine Your Risk Response

For each identified risk, you have four options for how to respond.

Step 5: Create Your Risk Treatment Plan

Your risk treatment plan documents the specific actions you will take to address each significant risk, along with timelines, responsibilities, and budget. This plan becomes your security roadmap — the document that guides your security investment and activities over the coming year.

For each risk being mitigated, specify the control or controls to be implemented, the person responsible for implementation, the target completion date, the estimated cost, and how you will verify that the control is effective. Prioritise actions based on risk score, with the highest-scoring risks addressed first.

Budgeting for Risk Treatment

One of the most common challenges UK SMEs face when creating a risk treatment plan is determining an appropriate security budget. There is no universal formula, but industry benchmarks suggest that businesses should allocate between four and seven per cent of their IT budget to cyber security, with higher-risk industries such as financial services, healthcare, and legal services at the upper end of that range. For a business spending £50,000 per year on IT, this equates to a cyber security budget of £2,000 to £3,500 — sufficient to fund the most impactful controls for a small business.

When budget is limited, frame every control in terms of return on investment by comparing the cost of implementation against the risk reduction it delivers. Multi-factor authentication, for example, typically costs a few pounds per user per month but addresses credential theft — one of the highest-likelihood, highest-impact threats facing any business. Automated patch management can be included in a managed IT services agreement at minimal additional cost while significantly reducing the attack surface. Security awareness training programmes are available from as little as three to five pounds per user per month and directly target the human element that features in over eighty per cent of breaches. These cost-effective controls should form the foundation of any SME risk treatment plan before considering more expensive measures.

A well-constructed treatment plan also considers the interdependencies between controls. Implementing multi-factor authentication significantly reduces the risk from credential theft but requires that your identity management infrastructure supports MFA across all critical applications. Similarly, deploying endpoint detection and response is most effective when combined with a monitoring capability that can act on the alerts it generates. Planning your control implementations in a logical sequence — addressing foundational capabilities first, then building more advanced protections on top — ensures that each investment delivers maximum value and that controls work together as an integrated defence rather than a collection of isolated measures.

Quick Wins for UK SMEs

Some security controls deliver outsized risk reduction for relatively modest investment. Based on NCSC guidance and the Cyber Essentials framework, the following measures address the most common vulnerabilities in UK SME environments and should be prioritised in your treatment plan.

Step 6: Document and Communicate

Your risk assessment must be documented. This serves multiple purposes: it provides evidence of compliance with UK GDPR, it enables consistent review and updating, it communicates risks and priorities to senior management, and it supports Cyber Essentials certification if you pursue it.

Your documentation should include the scope of the assessment, the methodology used, the asset inventory, the identified threats and vulnerabilities, the risk scoring matrix and results, the risk treatment plan with assigned responsibilities, and a review schedule.

Present the findings to senior management in business terms, not technical jargon. Executives need to understand the business impact of the risks you have identified and the rationale behind your recommended investments. A risk that might cause £100,000 in losses and regulatory fines is a more compelling argument for a £10,000 security investment than a technical explanation of vulnerability severity scores.

Board-Level Reporting

Effective communication of cyber risk to senior leadership is a discipline in its own right. The NCSC has published specific guidance for board members on cyber security governance, and your risk assessment reporting should align with these expectations. Board-level reporting should focus on five key areas: the organisation's current risk profile expressed in business terms, the status of risk treatment actions and any overdue items, any significant changes in the threat landscape since the last report, the results of any security testing or incidents that occurred during the period, and a clear recommendation for any decisions or budget approvals required.

Avoid the temptation to present a comprehensive technical briefing. Senior leaders need to understand whether the organisation's risk posture is improving or deteriorating, whether resources are being deployed effectively, and whether any risks require their intervention. A one-page executive summary with a traffic-light risk dashboard — red for critical risks requiring immediate attention, amber for risks being actively managed, and green for risks at acceptable levels — is far more effective than a lengthy technical document. Supplement this with a more detailed appendix for those who want deeper information, but ensure the headline messages are clear and accessible to non-technical decision-makers.

Ongoing Risk Management

A risk assessment is a living document, not a one-off exercise. Schedule a comprehensive annual review, but also update the assessment whenever significant changes occur. Triggers for reassessment include adopting new technology platforms or cloud services, significant changes in business operations or structure, a security incident or near-miss, changes in the regulatory landscape, and new threat intelligence relevant to your industry or region.

The NCSC recommends that UK businesses also subscribe to their threat intelligence services and early warning notifications. These free services alert you to emerging threats that may affect your industry, allowing you to proactively update your risk assessment and controls before a new threat materialises.

Building a Risk-Aware Culture

Technical controls and documented processes are essential, but the most resilient organisations also cultivate a risk-aware culture where every employee understands their role in managing cyber risk. This means going beyond annual security awareness training to embed security thinking into everyday business operations. Encourage staff to report suspicious emails, unusual system behaviour, or potential security weaknesses without fear of blame. Recognise and reward security-conscious behaviour. Include cyber security responsibilities in job descriptions and performance reviews. And ensure that new starters receive security induction training before they are given access to systems and data.

A genuinely risk-aware culture transforms every employee from a potential vulnerability into an active sensor, dramatically improving your organisation's ability to detect and respond to threats before they cause serious harm. Studies consistently show that organisations with strong security cultures experience fewer successful attacks and recover more quickly when incidents do occur. Building this culture takes time and sustained effort, but it is one of the most cost-effective risk reduction measures available to any business.

Conclusion

A cybersecurity risk assessment is the single most important step any UK business can take to understand and manage its cyber risk. It replaces guesswork with evidence, ensures that security spending is directed where it will have the greatest impact, and provides the documentation needed to demonstrate compliance with UK GDPR and other regulatory requirements. The process does not need to be complex or expensive — for most SMEs, a thorough assessment can be completed in a few days with the right methodology and expertise.

Beyond regulatory compliance, a completed risk assessment delivers tangible business benefits that extend well into the future. It provides a clear framework for evaluating new technology purchases and business initiatives against their security implications. It strengthens your negotiating position with cyber insurance providers, who increasingly require evidence of formal risk management before offering competitive premiums. It builds confidence among clients and partners who need assurance that their data is handled responsibly. And it creates a culture of security awareness within the organisation, where risk-informed thinking becomes part of everyday decision-making rather than an afterthought.

If your organisation has never conducted a cybersecurity risk assessment, the time to start is now. Begin with the methodology outlined in this guide, focus on your most critical assets and the most likely threats, and build from there. Perfection is not the goal — progress is. Even a basic risk assessment that identifies your top five risks and puts in place a plan to address them puts your business in a dramatically stronger position than the majority of UK SMEs operating without any structured approach to cyber risk management.

The businesses that suffer most from cyber attacks are overwhelmingly those that never assessed their risks, never identified their vulnerabilities, and never implemented the basic controls that would have prevented the breach. A formal risk assessment ensures your business is not among them.