Most organizations that come to us after a security incident share one characteristic — they never conducted a formal cybersecurity risk assessment. They invested in firewalls, purchased antivirus licenses, and even hired IT specialists. But nobody asked the fundamental question: what risks are we actually accepting, and did we consciously make that decision?
Cybersecurity Risk Assessment (CRA) is not just another formal procedure required by regulators. It is the foundation upon which every effective security program is built. Without CRA, an organization operates blindly — reacting to incidents instead of preventing them, spending budget on solutions that do not address actual threats, and unable to demonstrate to itself or auditors that its decisions have rational justification.
In this guide, we will walk you through the entire process — from selecting a methodology, through threat modeling and risk scoring, to building a security roadmap that can be presented to the board.
What Is Cybersecurity Risk Assessment and Why Every Organization Needs It
Cybersecurity risk assessment is a systematic process of identifying, analyzing, and evaluating cyber threats to which an organization is exposed. Its goal is not to determine whether the organization “is secure” — because no organization is fully secure. The goal is to understand what risks exist, what their likelihood and potential impact are, and what actions should be taken.
The Paradigm Shift: From “Are We Secure?” to “What Risks Are We Accepting?”
This is a fundamental mindset change that distinguishes mature organizations from those that treat cybersecurity as an operational cost. The question “Are we secure?” has no good answer — because absolute security does not exist. The question “What risks are we accepting?” is specific, measurable, and enables conscious decision-making.
An organization that has gone through a formal CRA process can state: “We know that the risk of a ransomware attack on our production systems is high. We implemented network segmentation and immutable backups, which reduced residual risk to an acceptable level. The risk of an attack on development systems is medium, and we accepted it due to low business impact.”
Such a declaration is fundamentally different from “we have a firewall and antivirus, so it should be OK.”
Statistics That Should Motivate Action
Industry report data clearly demonstrates the value of formal cyber risk management:
- Organizations with formal cyber risk management reduce financial losses by 48% (McKinsey Digital Risk Report)
- The average cost of a data breach in 2025 was $4.88M globally and EUR 4.35M in the EU (IBM Cost of a Data Breach Report)
- 68% of security breaches result from human error or configuration issues — risks that CRA helps identify and address
- Mean time to detect a breach averages 194 days — organizations with formal CRA detect incidents 42 days faster
Risk Assessment Methodologies: ISO 27005, NIST RMF, FAIR
Choosing a methodology is the first decision to make. There is no “best” methodology — there is the one that best fits the organizational context.
ISO 27005 — For Organizations Within the ISO Ecosystem
ISO 27005 is a standard for information security risk management, designed as a natural complement to ISO 27001. If your organization is implementing or holds ISO 27001 certification, ISO 27005 is the logical choice.
Key characteristics:
- Full compatibility with the Statement of Applicability (SoA) required by ISO 27001
- Asset-based approach — each risk is linked to a specific information asset
- Four-stage process: context → risk assessment → risk treatment → risk acceptance
- Flexibility in scoring methods (qualitative, quantitative, or mixed)
When to choose: Organization holds or plans ISO 27001, wants an integrated management system, needs compatibility with European regulations.
NIST Risk Management Framework (RMF) — For the Public Sector and Critical Infrastructure
NIST RMF (Special Publication 800-37) is a framework developed by the U.S. National Institute of Standards and Technology. It is the de facto standard in the public sector and increasingly adopted in the private sector, particularly by companies operating globally.
Key characteristics:
- Seven steps: Prepare → Categorize → Select → Implement → Assess → Authorize → Monitor
- Strong emphasis on continuity — RMF is a continuous process, not a one-time project
- Detailed security controls catalog (NIST SP 800-53) with over 1,000 controls
- Integration with NIST Cybersecurity Framework (CSF 2.0) — Identify, Protect, Detect, Respond, Recover, Govern
When to choose: Organization works with the public sector, needs a detailed controls catalog, wants a framework covering the entire system lifecycle.
FAIR (Factor Analysis of Information Risk) — For Boards Thinking in Currency
FAIR is the only strictly quantitative methodology among the three. Instead of rating risk as “high,” “medium,” or “low,” FAIR calculates Expected Loss — the expected financial loss expressed in dollars, euros, or pounds.
Key characteristics:
- Risk quantification in monetary values — enables comparison with other business risks
- Ontological model: Loss Event Frequency × Loss Magnitude = Risk
- Distinction between Primary Loss (direct losses) and Secondary Loss (fines, reputational damage, legal costs)
- Monte Carlo simulations to account for uncertainty
When to choose: The board needs financial arguments, the organization wants to compare cyber risk with other business risks, ROI justification for security investments is needed.
Methodology Comparison
| Criterion | ISO 27005 | NIST RMF | FAIR |
|---|---|---|---|
| Approach | Asset-based, qualitative/mixed | Control-based, iterative | Quantitative, financial |
| Output | Risk level (scale) | Risk posture + controls plan | Expected loss (EUR/USD) |
| Complexity | Medium | High | High (requires data) |
| Implementation time | 2-4 weeks | 4-8 weeks | 3-6 weeks |
| Best for | ISO 27001, SMEs, EU | Public sector, infrastructure | CFO, board, insurance |
| Required competencies | Security analyst | Security architect | Risk analyst + historical data |
At nFlo, we most commonly apply a hybrid approach — ISO 27005 as the base framework with FAIR elements for key risks presented to the board. This maintains formal ISO 27001 compliance while delivering to the board in the language they understand — money.
Threat Modeling with MITRE ATT&CK
Asset inventory and vulnerability identification are one thing. But to assess risk, we need to understand who, how, and why might attack us. This is where threat modeling with the MITRE ATT&CK framework comes in.
What Is MITRE ATT&CK and Why It Is Groundbreaking
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base of tactics and techniques used by real-world threat actors. Unlike theoretical models, ATT&CK is based on observations from actual attacks — each technique has associated APT groups that employed it and documented campaigns.
The framework encompasses 14 tactics (from Initial Access to Impact), over 200 techniques, and hundreds of sub-techniques. Each has associated:
- Technical description of execution methods
- APT groups that employ it
- Tools and software used for execution
- Recommended detection and mitigation methods
Practical Threat Modeling — Step by Step
Step 1: Identify threat actor profile. Based on industry, location, and threat intelligence data, we determine which APT groups are relevant. For example, the financial sector in Europe should consider groups like FIN7, Lazarus Group (North Korea), and groups affiliated with Russian GRU.
Step 2: Map techniques to assets. For each critical system, we determine which ATT&CK techniques are realistic. For example, for an ERP system exposed via VPN:
- T1133 (External Remote Services) — entry vector through VPN
- T1078 (Valid Accounts) — use of stolen credentials
- T1486 (Data Encrypted for Impact) — ransomware on ERP
- T1567 (Exfiltration Over Web Service) — data theft via cloud
Step 3: Assess existing detection and prevention controls. For each technique, we check whether we have:
- Preventive control (is the technique blocked?)
- Detective control (will the attack be detected?)
- Corrective control (can we respond and remediate?)
Step 4: Identify gaps. Techniques that have neither preventive nor detective controls represent the highest risk. These gaps become priorities in the remediation plan.
Example: ATT&CK Matrix for a Mid-Sized Manufacturing Company
| Tactic | Technique | Preventive Control | Detective Control | Gap |
|---|---|---|---|---|
| Initial Access | T1566 Phishing | Email gateway + training | SIEM alerting | Low |
| Initial Access | T1133 External Remote Services | VPN + MFA | VPN logs in SIEM | Low |
| Execution | T1059 Command & Scripting | AppLocker (partial) | EDR | Medium |
| Persistence | T1053 Scheduled Task | None | None | High |
| Lateral Movement | T1021 Remote Services | Segmentation (partial) | NDR | Medium |
| Exfiltration | T1567 Exfiltration Over Web | DLP (none) | None | High |
| Impact | T1486 Data Encrypted | Backup | No early detection | High |
Risk Scoring: Likelihood and Impact Matrix
After identifying threats and assessing controls, we move to scoring — a quantitative or qualitative assessment of risk levels.
Likelihood × Impact Matrix
This is the most widely used method for assessing cybersecurity risk. Each risk is evaluated across two dimensions:
Likelihood — on a scale of 1-5:
- Very Low — once in 10+ years, requires advanced state-level capabilities
- Low — once in 3-10 years, requires dedicated attacker resources
- Medium — once in 1-3 years, available tools and techniques
- High — once per quarter to year, typical attack scenario
- Very High — multiple times per year, automated attacks, common exploits
Impact — on a scale of 1-5:
- Minimal — no downtime, no financial losses
- Low — downtime up to 4h, losses up to EUR 12,000
- Medium — downtime 4-24h, losses EUR 12,000-120,000
- High — downtime 1-7 days, losses EUR 120,000-1.2M
- Critical — downtime over 7 days, losses over EUR 1.2M, regulatory fines
Risk Score = Likelihood × Impact
Risk Heat Map
Scoring results are presented on a heat map, which serves as an intuitive communication tool — particularly useful in board-level discussions.
| Impact 1 | Impact 2 | Impact 3 | Impact 4 | Impact 5 | |
|---|---|---|---|---|---|
| Likelihood 5 | 5 (Medium) | 10 (High) | 15 (Critical) | 20 (Critical) | 25 (Critical) |
| Likelihood 4 | 4 (Low) | 8 (Medium) | 12 (High) | 16 (Critical) | 20 (Critical) |
| Likelihood 3 | 3 (Low) | 6 (Medium) | 9 (Medium) | 12 (High) | 15 (Critical) |
| Likelihood 2 | 2 (Low) | 4 (Low) | 6 (Medium) | 8 (Medium) | 10 (High) |
| Likelihood 1 | 1 (Low) | 2 (Low) | 3 (Low) | 4 (Low) | 5 (Medium) |
Decision zones:
- Critical (15-25): Immediate action required — escalate to the board
- High (10-14): Mitigation plan within 30 days
- Medium (5-9): Planning within the security roadmap
- Low (1-4): Monitoring and acceptance with documented justification
Asset Inventory and Critical Asset Identification
You cannot manage the risk of something you do not know exists. Asset inventory is the foundation of CRA — and simultaneously the step that many organizations skip or perform superficially.
Asset Categories
A complete inventory covers not just servers and laptops but the entire information ecosystem:
Information assets:
- Customer data, personal data (GDPR)
- Intellectual property, trade secrets
- Financial data, strategic reports
- Technical documentation, source code
Technology assets:
- Servers (physical and virtual), cloud services
- Network devices (routers, switches, firewalls)
- Workstations, mobile devices
- Business applications, ERP/CRM systems
- OT/ICS infrastructure (if applicable)
Process assets:
- Critical business processes (e.g., payment processing)
- ICT supply chain
- SLA agreements with vendors
Human assets:
- Employees with privileged access
- System administrators
- External vendors with remote access
Asset Criticality Classification
Each asset is classified by criticality based on the three CIA dimensions (Confidentiality, Integrity, Availability):
| Level | Confidentiality (C) | Integrity (I) | Availability (A) |
|---|---|---|---|
| 5 — Critical | Top secret data, fines > EUR 250K | Change causes catastrophe | RTO < 1h, RPO < 15 min |
| 4 — High | Personal data, financial | Change causes significant losses | RTO < 4h, RPO < 1h |
| 3 — Medium | Internal data | Change requires correction | RTO < 24h, RPO < 4h |
| 2 — Low | Internal public data | Change is noticeable | RTO < 72h, RPO < 24h |
| 1 — Minimal | Publicly available data | Change without consequences | No SLA requirements |
Asset Criticality = max(C, I, A)
Assets with criticality 4-5 require dedicated risk analysis. Assets with criticality 1-2 can be assessed as groups.
Existing Controls Assessment with Maturity Scoring
Identifying threats alone is not enough — we need to know how effective our current safeguards are. This is where security control maturity assessment comes in.
Control Capability Maturity Model
Each security control is assessed on a scale of 1-5:
| Level | Name | Description | Example (control: vulnerability management) |
|---|---|---|---|
| 1 | Initial | Ad hoc, no process | Vulnerability scanning done “when someone remembers” |
| 2 | Repeatable | Basic process, partial documentation | Quarterly scanning, but no SLA for remediation |
| 3 | Defined | Formal process, documented | Monthly scanning, SLA for critical: 72h |
| 4 | Managed | Measured, KPIs, continuous improvement | Weekly scanning, automated tickets, dashboard |
| 5 | Optimized | Automated, integrated, predictive | Continuous scanning, auto-patching, CI/CD integration |
Sample Control Maturity Assessment
| Control Domain | Current Level | Required Level (NIS2) | Gap |
|---|---|---|---|
| Access management | 2 | 3 | -1 |
| Vulnerability management | 2 | 4 | -2 |
| Incident management | 1 | 4 | -3 |
| Backup and recovery | 3 | 4 | -1 |
| Data encryption | 3 | 3 | 0 |
| Security monitoring (SOC) | 1 | 3 | -2 |
| Training and awareness | 2 | 3 | -1 |
| Supply chain security | 1 | 3 | -2 |
Gaps of -2 or greater require priority addressing in the security roadmap.
Risk Treatment Options
After identifying and evaluating risks, the organization must decide what to do with them. ISO 27005 defines four risk treatment options:
1. Mitigate — Reduce the Risk
The most common option. We implement security controls that reduce the likelihood or impact of an event.
Example: Risk of administrative account compromise (Risk Score: 20)
- Control: Implement MFA for all admin accounts
- Cost: ~EUR 1,200
- Effect: Likelihood reduction from 5 to 2 → new Risk Score: 8
- Risk reduction: ~15% of total organizational risk
2. Transfer — Transfer the Risk
Transferring the financial consequences of risk to another entity, most commonly an insurer.
Example: Risk of personal data breach (potential GDPR fine)
- Control: Cyber insurance policy with EUR 1.2M limit
- Cost: ~EUR 7,000-14,000 annually
- Effect: Financial impact transferred to insurer
- Note: Transfer does not eliminate reputational or operational risk
3. Avoid — Eliminate the Risk
Abandoning the activity or system that generates the risk.
Example: Legacy FTP server exposed to the internet
- Decision: Migrate to cloud-based SFTP, decommission old server
- Cost: ~EUR 3,500 (migration)
- Effect: Risk eliminated — attack vector no longer exists
4. Accept — Accept the Risk
A conscious decision to accept the risk because the cost of mitigation exceeds potential losses or the risk is at an acceptable level.
Example: Risk of attack on internal wiki (Risk Score: 3)
- Decision: Accept risk with documented justification
- Condition: Signed off by risk owner
- Critical: Acceptance MUST be documented and approved by a person with appropriate authority level
Risk Treatment Decision Matrix
| Risk Score | Preferred Option | Required Approval |
|---|---|---|
| 15-25 (Critical) | Immediate mitigation or avoidance | Board / CEO |
| 10-14 (High) | Planned mitigation or transfer | CISO / CTO |
| 5-9 (Medium) | Mitigation in roadmap or acceptance | IT Manager |
| 1-4 (Low) | Acceptance or monitoring | Asset owner |
Quick Wins — Immediate Risk Reduction
One of the most important outputs of a CRA is a list of quick wins — low-cost, high-impact actions to reduce risk. Here are typical quick wins we recommend to nFlo clients:
1. MFA for Administrative Accounts
- Cost: ~EUR 1,200 (configuration + licenses)
- Implementation time: 1-2 weeks
- Risk reduction: ~15%
- Justification: 80% of account compromise breaches could have been prevented by MFA
2. Backup Verification and Testing
- Cost: ~EUR 500 (staff time)
- Implementation time: 1-3 days
- Risk reduction: ~10%
- Justification: 30% of organizations that experienced ransomware discovered their backups did not work
3. Privileged Account Review
- Cost: ~EUR 700 (staff time + tools)
- Implementation time: 1 week
- Risk reduction: ~10%
- Justification: The average organization has 3-4x more admin accounts than needed
4. Network Segmentation for Critical Systems
- Cost: ~EUR 2,000-3,500
- Implementation time: 2-4 weeks
- Risk reduction: ~12%
- Justification: Segmentation limits lateral movement — the most common attack escalation technique
5. Password Policy Update + Strong Password Enforcement
- Cost: minimal (AD/IAM configuration)
- Implementation time: 1-3 days
- Risk reduction: ~8%
- Justification: Weak passwords remain the number one entry vector in brute-force attacks
Combined risk reduction from 5 quick wins: approximately 55% — at a total cost below EUR 8,000.
Regulatory Requirements for Risk Assessment
Cybersecurity risk assessment is not optional — it is required by key regulations:
NIS2 (EU Directive 2022/2555) — Art. 21
The NIS2 Directive in Art. 21(2)(a) requires essential and important entities to implement “policies on risk analysis and information system security.” This is a direct requirement for conducting regular risk assessments.
Practical implications:
- Obligation for documented risk assessment methodology
- Regular reviews (minimum annually)
- Inclusion of ICT supply chain risks
- Reporting to the competent authority
DORA (EU Regulation 2022/2554) — Art. 5-6
The DORA Regulation imposes even more detailed requirements on the financial sector:
- Art. 5: ICT risk management framework — the management body bears personal responsibility
- Art. 6: Requirement to identify, classify, and document all ICT functions, information assets, and their interdependencies
- Obligation to conduct risk assessment before every significant change in ICT infrastructure
ISO 27001:2022 — Clause 6.1
ISO 27001 in Clause 6.1 requires:
- Establishing an information security risk assessment process
- Defining risk acceptance criteria
- Conducting repeatable and comparable assessments
- Identifying risks related to loss of confidentiality, integrity, and availability
Key point: ISO 27001 requires not only conducting a risk assessment but demonstrating that the process is repeatable — the same assessor, applying the same methodology, should reach similar results.
From CRA to Security Roadmap
A risk assessment alone does not improve security — the action plan that results from it does. We structure roadmaps in three time horizons:
Phase 1: Quick Wins (0-3 months)
Low-cost, immediate-impact actions:
- Implement MFA for privileged accounts
- Verify and test backup procedures
- Review and reduce privileged accounts
- Update password policies
- Network segmentation for highest-risk systems
- Initial awareness training for the board
Estimated budget: EUR 7,000-12,000 Expected risk reduction: 40-55%
Phase 2: Short Term (3-6 months)
Implementing key controls and processes:
- Deploy or expand EDR/XDR across all endpoints
- Launch vulnerability management process with SLAs
- Develop and implement an incident response plan
- Deploy SIEM or forward logs to an external SOC
- Penetration testing for critical systems
- Expanded security awareness training program
Estimated budget: EUR 25,000-70,000 Expected risk reduction: additional 20-30%
Phase 3: Long Term (6-12 months)
Building a mature security program:
- Implement Zero Trust Architecture for key segments
- Launch threat intelligence program
- Deploy DLP (Data Loss Prevention)
- ISO 27001 certification (if planned)
- Security process automation (SOAR)
- Red team / blue team exercises
- Regular reviews and risk assessment updates
Estimated budget: EUR 50,000-120,000 Expected risk reduction: additional 10-15%
Combined Roadmap Effect
After 12 months of roadmap execution, a typical organization reduces its risk profile by 70-85% compared to the baseline. Residual risk should fall within the acceptable boundaries defined by the board.
How nFlo Conducts Cybersecurity Risk Assessments
At nFlo, we have completed over 500 security projects, a significant portion of which included formal risk assessments. Our process includes:
- Kickoff and business context (1 day) — understanding industry, regulations, organizational structure, and business objectives
- Asset inventory (2-3 days) — automated network scanning + interviews with system owners
- Threat modeling (2-3 days) — MITRE ATT&CK analysis tailored to the organization’s profile
- Controls assessment (3-5 days) — maturity assessment of existing safeguards, interviews, documentation review
- Scoring and risk analysis (2-3 days) — risk matrix, heat map, quantification of key risks
- Report and roadmap (2-3 days) — board-level report, detailed technical report, roadmap with budget
Total time: 2-3 weeks Final deliverables: Risk report + security roadmap + board presentation
Summary
Cybersecurity risk assessment is not a one-time project — it is the foundation of a continuous security management process. Organizations that take CRA seriously make better investment decisions, respond faster to incidents, and meet regulatory requirements.
Key takeaways:
- Choose a methodology matched to your context — ISO 27005 for ISO, NIST RMF for public sector, FAIR for boards
- Model threats realistically with MITRE ATT&CK — do not fantasize about state-level attacks if you are an SME
- Scoring must be repeatable — Likelihood × Impact matrix with clear criteria
- Quick wins deliver immediate results — 5 actions for under EUR 8,000 can reduce risk by 55%
- The roadmap is the final product — CRA without an action plan is an academic exercise
- Regulations require CRA — NIS2, DORA, and ISO 27001 leave no ambiguity
Do not wait for an incident to discover what risks you are accepting. Conduct a risk assessment now — and make decisions based on data, not assumptions.
Related Terms
Learn More
- What Is Risk Management — A Complete Guide
- How to Conduct a KSC/NIS2 Readiness Audit — A Practical Guide for CISOs
- Risk Management in Cybersecurity — How to Make Informed Decisions
Explore Our Services
- Security Audits — comprehensive assessment of your organization’s security posture
- NIS2 Compliance — support with implementing NIS2 directive requirements
- Risk Analysis Reviews and Consulting — professional risk assessment tailored to your industry
Need expert support? nFlo team can help secure your organization:
Related topics
See also:
