Risk assessment
A cyber risk assessment sets out what matters to your business, what can go wrong and how hard it would hit your work. The result is a risk map for the board, with priorities and a plan for the first 90 days. It is the starting point for NIS2, for client questionnaires and for your insurer.
01 · copy the link to this sectionThe situation
Time and budget for security are limited. A risk assessment tells you where to put them.
Without a risk assessment, security moves in fits and starts. You buy the tool a vendor recommends, or you chase the latest questionnaire.
The assessment starts from the work, not from the technology. Which data and which systems would block orders, production or payments if they stopped? That tells you what to protect first and how much it is worth spending.
For organisations subject to NIS2 it is not optional. Risk analysis policies are the first of the measures in Article 24 of Legislative Decree 138/2024.
Typical scenario
A company has just replaced its firewall, but its backups can be reached from the same network as the offices. An attack that encrypts the files would encrypt the backups too. The risk assessment puts this at the top of the list, before any purchase.
02 · copy the link to this sectionHow we work
We work with management, IT and the people who run the processes that matter.
The systems, data, services and suppliers that matter to the business, with the person responsible for each.
What can happen: attacks, mistakes, failures, a supplier that stops. NIS2 requires an all-hazards approach that also covers the physical environment.
Where you are exposed: access, backups, updates, procedures. Where needed, with a vulnerability assessment.
How hard it would hit the business and how likely it is. It is estimated with the people who run the processes, not only with IT.
A choice for each risk: reduce it, transfer it, for example through insurance, avoid it or accept it in writing.
03 · copy the link to this sectionWhat you keep
The risk map. One page with the main risks, ordered by impact and likelihood.
The priorities. What to do first, who does it and why, in plain language.
The plan for the first 90 days. Activities, dates and owners, to review at every meeting.
The risk register. The working document for IT and for whoever manages suppliers. It can be updated without starting from scratch.
04 · copy the link to this sectionReference
Updated 7 November 2026
In short: the same assessment answers several requests. You write it once and keep it up to date.
| For | What is required | Reference |
|---|---|---|
| NIS2 entities | Risk analysis policies. Among the evidence, a risk management plan and a risk treatment plan. | Legislative Decree 138/2024, Article 24(2)(a) · ACN FAQ MSB.11 |
| Suppliers to NIS2 entities | The entity assesses and documents the risk of its supplies. That is why it asks suppliers for information and assurances. | ACN FAQ MSB.13 |
| Italian public bodies under Law 90/2024 | A cybersecurity unit that produces and updates a plan for managing cyber risk. | Law No. 90 of 28 June 2024, Article 8 |
| Personal data in Italy | Security measures appropriate to the risk to people’s rights. | Regulation (EU) 2016/679, Article 32 |
| Personal data in San Marino | Security measures appropriate to the risk, supervised by the San Marino Data Protection Authority. | Law No. 171 of 21 December 2018, Article 33 |
| Clients and insurers | Questionnaires on access, backups and incidents. The answers come from the same assessment. | — |
This box is for information only and is not legal advice.
05 · copy the link to this sectionFrequently asked questions
06 · copy the link to this sectionObservatory
Analysis and guides from the Strategic editorial team.
Many intrusions leave traces outside the company before they show any sign inside: credentials for sale, domains imitating the brand, suppliers that have been hit. Which signals to check and what to do when they appear.
5 August 2026Backup repairs damage that has already been done. It does not stop anyone getting in, and it does not tell you who did. Here are the three pillars of basic defence, and the quarterly review to run with IT and management.
22 April 2026Remote support, shared accounts, programs installed years ago and never removed. Supplier access is one of the most exploited ways in. How to list it, limit it, log it and close it.
12 October 2026Three copies, two media, one off site, one isolated and zero errors when you test them. The backup rule explained through a grandfather’s drawers, and turned into decisions for management, IT and suppliers.
19 January 2026The essential parts of this page print as a short summary of a few pages, without images or invitations to get in touch.
07 · copy the link to this sectionContact
A few lines are enough: what kind of company you are, why you need the assessment, and any deadlines. We reply by email, usually within two working days.
Please do not put credentials, IP addresses or vulnerability details in the form. We exchange them later, over the channels we agree.
Or write to us:WhatsAppstaff@strategic.sm
On WhatsApp, messages are answered by Strategic’s AI assistant. Please do not use it for confidential information.
