What Is a Cybersecurity Risk Assessment? | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

To perform a thorough cyber risk assessment, first determine the following:

The organization’s appetite for risk. What level of risk is the organization willing to accept? Are there certain risks that, for one reason or another, aren’t considered harmful enough to avoid?

The organization’s risk tolerance. How far is the organization willing to bend or stretch its risk appetite before considering a risk unacceptable?

The next steps should be as follows:

1. Perform a thorough audit of the ecosystem. This should include suppliers, business partners, contractors, remote staff, and all internal infrastructure. A risk profile can only be built effectively by knowing what systems are at risk. 
2. Working with stakeholders from across the organization, brainstorm potential threats the organization will likely face.
3. For each threat, assess its potential impact, assuming a worst-case scenario.
4. Assess the likelihood that the organization will have to contend with each threat.
5. Once both impact and the likelihood of each threat are determined, categorize it based on the level of risk it poses to the organization.
6. Develop countermeasures for whichever risks are determined to fall outside the organization’s appetite and tolerance.
7. Review and revisit the risk register, performing new assessments regularly and as the situation calls for it.