Business context
Identify important information, services, systems, dependencies and the people who own the risk.
Cybersecurity Risk Assessments
A cyber security risk assessment identifies the threats and weaknesses that could affect your organisation's important information and services, and rates the risk they pose to the business. Umbrella Tech connects technical findings with business impact, so decision-makers can see which risks matter most, assign owners, choose treatments and understand the risk that remains.
When this assessment is useful
A cyber risk assessment is useful before major investment decisions, when a board or insurer asks how cyber risk is managed, when a framework such as ISO/IEC 27001 requires a formal risk process, or after significant change such as a merger or new system. It also helps when a list of vulnerabilities exists but nobody can say which ones matter most to the business.
Assessment scope
Threats and weaknesses
Consider realistic scenarios, from phishing and ransomware to supplier failure and human error.
Existing controls
Review how well current controls reduce each risk, using evidence rather than assumptions.
Risk rating
Rate likelihood and consequence using an agreed method that leadership understands.
Treatment planning
Identify actions, owners, priorities and residual-risk decisions.
Evidence and access
Depending on scope, evidence may include system and asset lists, network and architecture diagrams, previous audit or assessment reports, Microsoft 365 and identity settings, incident history, supplier lists, and interviews with the owners of key services. We agree access and handling before the assessment begins.
System and asset lists
Network and architecture diagrams
Previous audit or assessment reports
Microsoft 365 and identity settings
Incident history
Supplier lists
Interviews with the owners of key services
Findings that lead to action
You receive a cyber risk register with a traceable rationale for each rating, a treatment plan with owners and priorities, and a summary leadership can use to make decisions. The register can feed an ISMS, a governance programme or a project business case.
Illustrative findingsExamples only
- ExampleCritical service that depends on a single administrator account
- ExampleCustomer data held by a supplier with no security review
- ExampleBackups stored where ransomware could reach them
These are examples of what an IT risk assessment can uncover, not findings about your organisation.
How it runs
Assessment method
01
Set the context
Agree scope, risk criteria and the people who own the risks.
02
Identify risks
Map important assets and services and the scenarios that could affect them.
03
Analyse and rate
Assess existing controls and rate each risk with the agreed method.
04
Plan treatment
Present the register, agree treatments and record residual-risk decisions.
From assessment to remediation
Treatment actions can be delivered by your team, your provider or by us through Compliance Remediation and our Cybersecurity services. Ongoing review of the register belongs in Cybersecurity Governance.
Assessment outputFindings and remediation roadmap
Umbrella TechWe deliver the improvements
DesignImplementValidate
Your organisationYour internal team
Your partnerYour existing technology provider
Frequently asked questions
Can't see your question? Ask us directly →
What does a cyber security risk assessment include?
Setting the context and criteria, identifying assets and scenarios, assessing existing controls, rating each risk, and a risk register with a treatment plan. It can be aligned with ISO/IEC 27001, the Essential Eight or other frameworks you need to meet.
How is this different from a technical security assessment?
A technical assessment examines control weaknesses. A risk assessment connects those weaknesses with business impact, ownership and treatment decisions. The two can be combined within an agreed scope.
How long does the assessment take?
It depends on the number of services and systems in scope, the availability of business and IT owners, and existing documentation. We confirm scope and timing in discovery.
What evidence or access is required?
Asset and system information, previous reports, key configuration settings, and time with the people who own business services and IT. We agree the list first.
How much does it cost?
Cost depends on scope, organisational complexity and how much existing information can be reused. We confirm scope and cost in discovery.
Establish your current position
Tell us what prompted the question and which services matter most. We will scope a risk assessment that supports real decisions.