Key takeaway
Track the asset, scenario, impact, likelihood, controls, residual risk and decision owner; set a review date for accepted risk.
Identify assets and business dependencies
Inventory data, applications, accounts, networks, suppliers and processes. Record an owner, data sensitivity, availability needs and dependent services for each asset. Connect a technical finding to the operation, data or recovery cost it could affect.
Assess threat scenarios
Describe a concrete event such as account compromise, data extraction from exposed cloud storage, vulnerability exploitation, ransomware or supplier outage. Assess likelihood, controls and impact using evidence, and state uncertainty. A technical severity score alone is not enough for business priority.
Set priorities and risk ownership
Consider asset criticality, exploitability, credible threat information, control effectiveness and impact together. Name a business owner authorized to decide on risk, separately from the technical remediation owner where appropriate. Set an escalation threshold and distinguish inherent risk before controls from residual risk after treatment.
Document treatment and accepted risk
Choose treatment according to the scenario’s business impact. Record the decision owner and review trigger; a contract or insurance does not remove the threat or transfer every responsibility.
| Decision | What changes | What to record |
|---|---|---|
| Reduce | Controls or remediation reduce risk. | Owner, action, date and verification. |
| Transfer | A contract or insurance reallocates agreed consequences. | Coverage, exclusions and retained responsibility. |
| Avoid | Stop or redesign the risky activity. | Business impact and the transition decision. |
| Accept | An authorized owner accepts residual exposure. | Rationale, remaining impact, controls and a review trigger or date. |
Revisit after incidents and change
A new vulnerability, threat, service, supplier or cloud configuration can change risk. After an incident, feed impact, detection time, response and recovery back into the register. Report high residual risks, overdue actions, recurring causes and decisions needed.
Connect risk to business consequences
Risk assessment goes beyond counting technical gaps. Consider loss of corporate data and intellectual property, service interruption, recovery work, effects on people and contractual consequences. For a scenario such as an unavailable sales website, add duration and dependencies. Validate assumptions with the business owner so priorities reflect operations and recovery needs.
Financial, trust and workflow considerations
When choosing treatment, consider recovery costs, continuity of revenue-producing services and responsible data handling. Consider clear policies, training and incident communication in relation to customer and employee trust. Track collaboration and time spent on crisis work versus planned IT work, checking the effect of documented tasks and escalation against actual outcomes. Use control evidence in customer assurance and supplier discussions.
Measure continuity and program progress
Set recovery objectives and backup tests for critical services. Track risk age, overdue treatments, repeat incidents and actual downtime with like-for-like coverage. Use measures to review accepted risk and investment decisions. Update the plan when services or threats change, and exercise response roles before an incident requires them.