CYBCybersecurity

Cyber risk assessment: how it is done and what the board needs to see

A cyber risk assessment sets out what matters to the company, what can go wrong and how much it would weigh on the business. The board needs a single page, with the decisions it has to take.

Strategic editorial team 12 November 2026 8 min read

Cover: “Cyber risk: one page for the board”, Cybersecurity

A cyber risk assessment takes five steps. You list the assets and data that matter, describe the threats, look for weaknesses, estimate the impact on the business and decide what to do about each risk. The board does not need the full register. It needs one page with the main risks, the decisions to take and the risks the company chooses to accept, with a signature. For companies covered by NIS2, risk analysis is the first of the required measures, and the management body approves how it is carried out.

What is a cyber risk assessment?

It is a working document that answers three questions. What would hurt us most if it stopped or fell into the wrong hands? How likely is it to happen? What are we doing to prevent it, and who is doing it?

It is not a list of technical flaws, and it is not the output of a tool that scans the network. Those are useful pieces, but they come later. The assessment starts from the company’s work, meaning orders, production, payments and customer data. Then it looks at the systems that support that work.

The result is a ranked list. At the top are the few risks that deserve time and budget now. At the bottom are the ones to keep an eye on or to accept.

How is it done, step by step?

1. Assets and data. You start from the processes that cannot stop and work back to the systems, data and suppliers behind them. For each item you write down who is responsible. An ERP system with no owner is already a risk.

2. Threats. You describe what could happen, with concrete examples. An attack that encrypts files, an email that gets a supplier’s bank details changed, a mistake during an update, a failure in the server room, a supplier that stops working. Italy’s NIS2 law requires an all-hazards approach, which also protects the physical environment of the systems.

3. Weaknesses. You look for where the company is exposed. Logins without a second factor, backups reachable from the office network, software that is not up to date, procedures that exist only in one person’s head. A vulnerability assessment helps with the technical part.

4. Impact and likelihood. For each risk you estimate how much it would weigh on the business and how likely it is. This is done with the people who run the processes, not just with IT. The head of production knows better than anyone what a day of downtime means.

5. Treatment. For each risk you choose a course of action and an owner. There are four options. You can reduce the risk, transfer part of it through insurance or a contract, avoid it by changing the way you work, or accept it. An accepted risk is written down, with the role of the person who accepts it and the date when it will be reviewed.

How do you estimate impact and likelihood without made-up numbers?

With short scales described in words. A scale from 1 to 4 is enough, as long as each level has a concrete meaning that is the same for everyone. Here is an example to adapt.

Level	Impact on the business	Likelihood
1	A few hours of disruption, no data lost	Never happened, system barely exposed
2	One department stopped for a day	Possible, it happens in the sector
3	Orders or production stopped for several days, customer data exposed	Already happened to us or to a similar company
4	Downtime of a week or more, harm to customers, notification duties	Known weakness that is easy to exploit

The score can be the product of the two numbers, or a colour grid. The method matters less than consistency. Two people assessing the same risk should reach a similar judgement. If they do not, the scale needs rewriting.

Figures are used where they really exist, for example the revenue of one day of downtime. Where they do not exist, a clear description is better than an invented number.

What does the board need to see?

One page, two at most. The full register stays with IT and with whoever manages suppliers. The board needs five things.

The main risks, usually between five and ten, written in plain words. “An attack that encrypts both the ERP system and its backups stops shipments for a week” is clear. “Unremediated critical vulnerabilities on the perimeter” is not.
The trend, meaning whether each risk has gone up, gone down or stayed the same since last time.
The decisions required, with the alternatives and their effect on time and budget.
The accepted risks, one per line, with who accepted them and when they will be reviewed.
The plan for the next 90 days, with activities, owners and dates.

For entities covered by NIS2 this is more than good practice. Legislative Decree 138/2024 (Italy’s NIS2 law) states that management bodies approve how the risk management measures are implemented, oversee their implementation and are liable for infringements (Article 23). The same people must also attend cybersecurity training. A clear page is the simplest way to approve something while knowing what you are approving.

Which mistakes are the most frequent?

The endless list. Two hundred identical lines help nobody decide. A few risks described well are better.
Everything is red. If every risk is high, none of them really is. It usually means the levels of the scale are not described.
Only IT at the table. Without the people who run production, sales and payments, the impact is a guess.
Done once, for a questionnaire. The assessment ages quickly, because systems, suppliers and attacks change.
Risks accepted verbally. If nobody signs, a year later nobody remembers who decided and why.
Actions with no name. An action without an owner and a date stays on paper.

What do NIS2 and the other rules require?

For NIS2 entities in Italy, risk analysis policies are the first of the minimum elements of the security measures (Legislative Decree 138/2024, Article 24, paragraph 2, letter a). The national cybersecurity agency, ACN, does not impose a specific template for the risk assessment document. Each entity can use the one it already has, or the one it considers most suitable (FAQ MSB.9). Among the evidence to prepare, ACN lists a risk management plan and a risk treatment plan (FAQ MSB.11).

Anyone processing personal data must apply security measures appropriate to the risk for the people concerned. In Italy, as across the EU, this is required by Article 32 of the GDPR. In San Marino, Article 33 of Law 171/2018 requires it in similar words.

Companies outside these rules often get there by another route. Customers covered by NIS2 have to assess the risk of their supply chain, and to do so they send questionnaires to suppliers. Insurers ask similar questions. A well-made assessment answers all of them with the same document.

How often should it be redone?

As a rule, once a year. This is our recommendation, not a legal deadline. It is reviewed straight away when something big happens, for example a move to the cloud, a new supplier for an important system, an acquisition, an incident or a new regulation.

Between reviews the register stays alive. Closed actions are marked and new risks are added. That way you do not start from scratch next time. External access also changes often, and it is worth checking it on every round. We explain how in the guide on supplier access.

In brief

A cyber risk assessment starts from the company’s work, not from technology.
There are five steps. Assets and data, threats, weaknesses, impact and likelihood, treatment.
Scales are described in words, so that two people reach the same judgement.
The board receives one page with the main risks, the trend, the decisions, the accepted risks and the 90-day plan.
For NIS2 entities it is the first of the required measures, and the management body approves how it is carried out.
It is updated once a year as a rule, and straight after any major change.

Frequently asked questions

Do we need software for the risk assessment?

Not always. For many companies a well-kept spreadsheet is enough. Software helps when there are many risks and many people updating them. What matters more is that the method is written down and the same for everyone.

How long does it take?

It depends on how many processes and systems are in scope. In a mid-sized company the longest part is gathering the information. A few short meetings are needed, prepared in advance, with the right people.

Who signs it off?

It is prepared by whoever looks after security, together with IT and the process owners. Management decides the priorities and the accepted risks. In NIS2 entities the management body approves how risks are managed.

Can we do it ourselves?

Yes, if someone in the company knows the systems and processes well and has the time to do it. Outside help is useful above all the first time, to set up the method, and when you need a view that does not depend on the people who run the systems.

Assessing risks with management, IT and the process owners, and preparing the page for the board, is the work of our cyber risk assessment service. When the systems at the top of the list need technical testing, the next step is a penetration test. For entities covered by NIS2, the assessment is the first step of NIS2 alignment.

Sources

Consulted on 7 November 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.