Security Risk Assessment: What It Covers, What You Receive, and How to Do One

Most businesses know they face cyber risk. However, very few can say exactly where that risk sits, how likely it is, or what it would cost. That gap is expensive. In fact, IBM’s Cost of a Data Breach Report 2026 puts the average U.S. breach at $11.5 million. A security risk assessment closes that gap. In short, it shows you what needs protecting, what could go wrong, and what to fix first. This guide explains, in plain English, what an assessment covers, how to run one, and what you should have in hand when it’s done.

What Is a Security Risk Assessment?

A security risk assessment is a structured process that identifies what your business needs to protect, finds the threats and weaknesses that could harm it, estimates the likelihood and impact of each risk, and produces a ranked plan to reduce them. A cybersecurity risk assessment, as it’s also called, turns vague worry into a prioritized list.

At its core, the process rests on one simple formula: risk = likelihood × impact. In other words, a weakness that is easy to exploit and would halt operations matters far more than one that is hard to reach and low in consequence.

To follow the process, it helps to know four terms:

• Asset: anything of value, such as laptops, servers, cloud apps, client records, or financial data
• Threat: anything that could cause harm, such as ransomware, phishing, or an insider mistake
• Vulnerability: a weakness a threat can exploit, such as unpatched software or a weak password
• Control: a safeguard that reduces risk, such as multi-factor authentication or tested backups

Most assessments follow a recognized methodology. For example, many providers build on NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments, which sets out how to identify, score, and communicate risk.

Security Risk Assessment vs. IT Security Assessment, Vulnerability Scan, Audit, and Penetration Test

Each of these terms answers a different question, which is why they’re so often confused. Here’s how they compare:

• Security risk assessment: Answers “Which risks matter most, and what should we fix first?” It’s performed by internal IT, a managed security provider, or an independent assessor, and it delivers a risk register, a heat map, and a prioritized roadmap.
• IT security assessment: Answers “Are our systems and controls set up correctly?” An IT security assessment reviews your configurations, user accounts, and existing controls. However, unlike a risk assessment, it doesn’t rank findings by business impact.
• Vulnerability scan: Answers “What known weaknesses exist right now?” It’s automated, so it’s fast, but it doesn’t tell you which weaknesses matter most to your business.
• Penetration test: Answers “How far could a real attacker get?” Ethical hackers run an authorized, simulated attack and report what they were able to exploit.
• Audit: Answers “Do our controls meet a specific standard?” An auditor compares your controls against a framework or regulation, such as HIPAA or SOC 2, and reports any exceptions.

In practice, most real engagements combine several of these. For instance, a risk assessment often uses vulnerability scan results as one of its inputs.

Why Your Business Needs a Security Risk Assessment

There are three main drivers, and most businesses face at least two of them.

First, breach exposure is real and costly. According to IBM’s 2026 report, the global average cost of a breach is $4.99 million. Without an assessment, you can’t tell which gaps put that money at risk.

Second, outside parties now ask for proof. Cyber insurance applications and client security questionnaires increasingly want evidence of a documented assessment, not just a promise that you take security seriously. As a result, a missing assessment can mean higher premiums, denied coverage, or a lost deal.

Third, regulators and boards expect it. More and more often, the question is not whether you’ve assessed your risk, but when you last did it.

For healthcare organizations, the stakes are even higher. In fact, IBM found that healthcare breaches average $6.64 million, the highest of any industry.

What a Security Risk Assessment Covers

A thorough assessment covers four areas: your assets and data, the threats and vulnerabilities they face, your current controls, and the likelihood and impact of each risk.

Assets and Data

To start, the assessment builds an inventory of what you have. That includes laptops, servers, cloud applications such as Microsoft 365 and Google Workspace, and the vendors connected to your systems. Just as importantly, it maps where sensitive data actually lives, whether that’s client files, patient records, or financial information. After all, you can’t protect what you haven’t found.

Threats and Vulnerabilities

Next, the assessment matches real threats to the assets they can reach. Common examples include ransomware, phishing, credential theft, unpatched software, and misconfigured systems. Unpatched software deserves special attention. According to the Verizon 2026 Data Breach Investigations Report, exploited vulnerabilities are now the top way attackers get in, accounting for 31% of breaches.

Current Controls

Then, the assessment reviews the safeguards you already have. This typically includes multi-factor authentication, endpoint protection, email security, backup and restore testing, logging, vendor access, and your incident response plan. If you’d like a quick self-check first, our baseline cybersecurity checklist is a good place to start.

Likelihood and Impact

Finally, each risk receives two ratings: how likely it is to happen, and how much harm it would cause. Some assessments use simple qualitative scores, such as low, medium, and high. Others use dollar-based estimates. Either way, the two ratings combine into a single priority, so your team knows exactly what to tackle first.

How to Conduct a Security Risk Assessment in 7 Steps

Whether you run it internally or with a partner, the process follows the same seven steps.

1. Define scope and goals. First, decide what’s in scope, such as specific locations, systems, or data types, and what the assessment needs to support, such as a compliance requirement or an insurance renewal.
2. Inventory assets and data. Next, list every device, application, vendor, and data store in scope. In addition, note who owns each one.
3. Identify threats and vulnerabilities. Then, determine which threats could reach each asset and which weaknesses they could exploit. Scan results and past incidents are useful inputs here.
4. Review existing controls. After that, check which safeguards are in place and whether they actually work. For example, a backup only counts if you’ve tested restoring from it.
5. Score likelihood and impact. Now, rate each risk on both scales and combine them into a priority level.
6. Prioritize and build the remediation plan. Once risks are ranked, decide what to fix, what to accept, and what to transfer, for instance through cyber insurance.
7. Document, assign owners, and reassess. Lastly, record every decision, give each action an owner and a deadline, and schedule your next review.

So how often should you repeat the process? At a minimum, once a year. Beyond that, you should also reassess after any material change. That includes a cloud migration, an acquisition, a new office or remote-work model, a major vendor change, a security incident, or a new regulation that applies to your business.

What You Should Receive When the Assessment Is Done

A good assessment ends with documents you can act on, not just a stack of technical findings. Specifically, you should receive:

• A plain-language executive summary for leadership
• A risk register listing every risk with its scores
• A heat map that shows where risk is concentrated
• A prioritized remediation roadmap with owners and timelines
• Evidence mapped to the frameworks you answer to
• A retest plan to confirm fixes worked

To picture what a risk register looks like, here are three typical entries:

• No MFA on remote access accounts: High likelihood and high impact, so it’s rated critical. The IT manager owns the fix.
• Backups not restore-tested in 12 months: Medium likelihood but high impact, so it’s rated high. The IT manager owns this one as well.
• A former vendor still has system access: Medium likelihood and medium impact, so it’s rated medium. The operations lead owns the follow-up.

As for who can do the work, the options are internal IT, a managed security provider, or an independent assessor. Whichever you choose, ask about credentials such as CISSP, CISM, CISA, or CRISC.

When a Security Risk Assessment Is Required

For many organizations, an assessment isn’t optional.

Healthcare. The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of the risks to electronic protected health information (45 CFR 164.308). Moreover, enforcement is active. In April 2026, the HHS Office for Civil Rights announced it had completed 13 investigations under its Risk Analysis Initiative.

Public companies. Under SEC Regulation S-K Item 106, public companies must describe their processes for assessing and managing cybersecurity risk.

Payments, service providers, and insurance. Similarly, PCI DSS, SOC 2, and cyber insurers all expect to see a documented assessment.

In each case, the assessment works best as part of a documented IT compliance program, rather than a one-time exercise. Requirements vary by framework and situation, so confirm the specifics that apply to your organization with your compliance or legal advisor.

How We Approach Security Risk Assessments at DivergeIT

At DivergeIT, every SecureIT engagement starts with our assessment. We review your email, laptops, accounts, and backups, then return a plain-language summary of your gaps and priorities. From there, findings feed directly into ComplyIT, so your documentation is ready when an auditor, insurer, or client asks for it. After that, SecureIT’s per-device tiers, Core, Plus, and Pro, cover the remediation work, so nothing stalls between finding a gap and fixing it.

Not sure whether your current setup would hold up? Find out if you’re covered

Frequently Asked Questions

What is a cybersecurity risk assessment?
A cybersecurity risk assessment is a structured review that identifies your critical assets, the threats and weaknesses that could harm them, and the likelihood and impact of each risk. The result is a ranked list of what to fix first.

How long does a security risk assessment take?
Most assessments for businesses with 50 to 1,000 employees take two to six weeks. The timeline depends on scope, number of locations and systems, and how quickly your team can provide access and documentation.

Is a security risk assessment required by law?
For some organizations, yes. HIPAA requires covered entities and business associates to assess risks to electronic patient data, and public companies must disclose their cyber risk processes to the SEC. PCI DSS, SOC 2, and many insurers also expect one.

How often should you do a security risk assessment?
At least once a year. In addition, reassess after any major change, such as a cloud migration, acquisition, new office, major vendor change, security incident, or new regulation that applies to your business.

What is the difference between a risk assessment and a penetration test?
A risk assessment ranks all of your risks by likelihood and business impact. A penetration test is a simulated attack that shows how far an attacker could get. Many organizations use pen test results as one input to their risk assessment.

What should a security risk assessment report include?
It should include an executive summary, a risk register with scores, a heat map, a prioritized remediation roadmap with owners and timelines, evidence mapped to your compliance frameworks, and a retest plan.

Who should perform a security risk assessment?
Internal IT, a managed security provider, or an independent assessor can perform one. Look for credentials such as CISSP, CISM, CISA, or CRISC, and choose someone who can explain findings in business terms.

Can a small business do its own security risk assessment?
Yes. A small business can start with a basic self-assessment using a checklist and the NIST SP 800-30 approach. However, an outside provider adds objectivity and expertise, and its documentation is more likely to satisfy insurers and auditors.