How To Conduct a Cybersecurity Risk Assessment for Your Small Business

Small businesses hold valuable payroll, employee and customer data, often with fewer resources to protect it, which is one reason attackers target them. In Verizon’s 2026 Data Breach Investigations Report, third parties were involved in 55% of breaches at small and medium-sized businesses. You don’t need a security team to complete an assessment, and the seven steps below show you how.

What Is a Cybersecurity Risk Assessment?

A cybersecurity risk assessment is a structured way to identify, evaluate and address issues that could put your business at risk of a cyber incident. It finds and ranks risk before an incident ever occurs. That makes it different from an incident response plan, which puts in writing the steps to take during or after an incident.

How To Conduct a Cybersecurity Risk Assessment Step by Step

Step 1: Define Your Scope and Goals

Start by writing down why you’re doing the assessment, since your reasons shape what it covers. You may want to find gaps before an attacker does, meet a regulatory requirement or prepare for an insurance application. The FTC Safeguards Rule, for example, requires covered financial institutions to periodically conduct and document a written risk assessment as part of their information security program.

Then decide what’s included. That might be every location, device and remote worker, or only the systems that handle payroll, employee and customer data. Name one person to own the assessment and set a target date to finish it.

Step 2: Inventory Assets, Data and Vendors

Next, list exactly what you’re protecting. This step doesn’t require special software. A simple spreadsheet works well for recording each asset, where it lives and who is responsible for it, and you can reuse the same file as your risk register in Step 5.

Cover these five areas:

• People: Who can access what, how access is granted and removed, and whether staff can spot suspicious requests.
• Technology: Devices, software, networks and cloud services, and whether updates and backups happen.
• Data: Where employee, payroll, and customer data live and who can reach it.
• Vendors: Third parties with access to your systems or data, and the security expectations in place.
• Processes: The routines that keep the rest in check, such as password policies, offboarding and backup testing.

Start with the systems that hold payroll, employee and customer data, since a problem there would likely cause the most harm.

Step 3: Identify Threats and Vulnerabilities

Now that you've taken account of all your assets, look at what could go wrong for each one, from phishing and ransomware to weak passwords, unpatched software and compromised vendor accounts.

A few practical questions can help you spot vulnerabilities:

• Is multifactor authentication (MFA) turned on for email, payroll and other key accounts?
• Are automatic updates enabled on devices and software?
• Who has administrator rights, and do they still need them?
• Has each vendor with access to your systems confirmed its security practices?

Every “no” or “not sure” is a vulnerability to carry into Step 4.

Step 4: Assess Likelihood and Impact

For each threat/asset pair identified, estimate how likely it is to occur and how bad the outcome would be. Outcomes can include downtime (where your business is temporarily shut down), data loss, regulatory exposure, reputational damage, and more.

Then use the matrix below to combine the two into an overall risk rating, which tells you which threats to address first.

Cybersecurity Risk Rating Matrix

Step 5: Prioritize Risks in a Risk Register

Rank findings in a risk register so the highest-impact risks get addressed first. A risk register is a running list of each risk, its ratings, who owns the fix and when it's due.

If you're not sure which fixes to tackle first, the Cybersecurity and Infrastructure Security Agency (CISA) offers a free Cyber Essentials guide for small businesses. It outlines basic actions that can help you decide where to begin.

Step 6: Decide How to Treat Each Risk

For each risk in your register, decide how you’ll respond. Your remediation plan in Step 7 covers only the risks you choose to reduce.

Here are four ways to treat a risk:

• Reduce: Fix the issue with steps such as MFA, software patches, tested backups, access reviews and employee training, starting with systems that hold payroll and employee data.
• Accept: Document low-rated risks and monitor them rather than fixing them right away.
• Avoid: Stop the activity or retire the system that creates the risk.
• Transfer: Shift some of the financial risk with a cyber liability insurance policy.

For any risk that remains, an incident response plan helps you act quickly if something happens.

Step 7: Document Findings and Build a Remediation Plan

Finally, write down what you found, how you chose to treat each risk, who owns each fix and the target date for completing it. For the risks you’re reducing, this record becomes your remediation plan, and it gives you a clear starting point for your next review.

Sample Risk Register Entry

Here's an example of what one row might look like:

Tools That Can Help With a Cybersecurity Assessment

Most small businesses can complete a first assessment themselves.

As your business grows, these types of tools can take your assessment further:

• Asset Discovery Tools: Find the devices and software connected to your network, including ones you may have missed.
• Vulnerability Scanners: Check systems for missing updates and known weaknesses.
• Access Review Reports: Show who has administrator rights and which accounts are still active.

Consider cybersecurity risk assessment services from an outside IT provider when your findings point to fixes you can't handle in-house, or when an insurer, client or regulator asks for an independent review. A provider can run a more in-depth IT security assessment using tools that require technical expertise.

How Often Should You Perform a Cybersecurity Risk Assessment?

The common baseline is at least once a year, plus any possible trigger events such as a new system, a new vendor, a shift to remote work, or after an incident. There's no universal requirement to reperform an assessment, however, some industries and regulations may set their own. It pays to double check what requirements may affect your business.