Risk Assessment Frameworks and Tools

A risk assessment is the systematic process of identifying what information assets need to be protected, what threats and vulnerabilities could affect them, how likely those threats are to materialise, and what the consequences would be if they did. The output of a risk assessment is not a document: it is a prioritised understanding of where an organisation is most exposed and where its security effort and investment should be directed.

Risk assessments are typically carried out by security or risk professionals, but managers contribute essential contextual knowledge that cannot be obtained any other way. You understand your team’s workflows, the data they handle, the tools they use, the pressures they face and the behaviours that are common in practice but may not be captured in formal policies. That knowledge is the foundation of an accurate and useful risk assessment.

NIST SP 800-30: The Risk Assessment Standard

NIST Special Publication 800-30, Guide for Conducting Risk Assessments, is one of the most widely used risk assessment frameworks globally. It forms part of the broader NIST Risk Management Framework and provides a structured, four-stage methodology for assessing risk:

• Prepare for the assessment: define the purpose, scope and assumptions of the assessment. Identify the information systems, data and processes to be assessed, and agree on the risk assessment criteria, including how likelihood and impact will be measured and expressed. This stage also involves identifying relevant threat sources and available threat intelligence.
• Conduct the assessment: identify threats and threat sources relevant to the scope; identify vulnerabilities and predisposing conditions that could be exploited; determine the likelihood that a threat would succeed in exploiting each vulnerability; determine the potential impact on the organisation if a threat were to succeed; and express the resulting risk as a combination of likelihood and impact, typically on a matrix.
• Communicate the results: share the findings with appropriate stakeholders in a format that supports informed decision-making. Risk assessment findings should be communicated to those with the authority and responsibility to act on them, including managers whose teams are affected by the identified risks.
• Maintain the assessment: because the threat landscape, the organisation’s assets and the effectiveness of controls all change over time, risk assessments must be reviewed and updated regularly. A risk assessment that was accurate twelve months ago may significantly understate current exposure if new systems have been adopted, new threats have emerged or existing controls have degraded.

The Risk Matrix: Likelihood and Impact

The most common tool for expressing the output of a risk assessment is the risk matrix, also known as a heat map. A risk matrix plots identified risks on a two-dimensional grid: the horizontal axis represents the likelihood that a risk will materialise, and the vertical axis represents the impact if it does. Each risk is assessed on both dimensions, typically on a scale of low, medium and high or on a numerical scale, and then plotted on the matrix.

Risks in the top right of the matrix, those that are both likely and high impact, are the highest priority for attention. Risks in the bottom left, those that are unlikely and low impact, may be accepted without further action. Those in between require judgement about the proportionate response.

The risk matrix is a management tool as much as a technical one. It creates a common visual language for communicating risk to stakeholders with different levels of technical expertise, supports transparent decision-making about risk priorities, and provides an auditable record of the organisation’s risk management process.

ISO 31000: The International Risk Management Standard

ISO 31000:2018, Risk Management Guidelines, provides a universal framework for risk management that applies across all types of organisations and all categories of risk, including but not limited to cyber security risk. It is not a certification standard in the same way as ISO 27001; rather, it provides principles and guidelines for embedding risk management thinking into organisational culture and decision-making.

The ISO 31000 framework emphasises that risk management should be integrated into all organisational processes and decision-making, rather than treated as a standalone exercise. For managers, this principle is directly applicable: every significant decision about how your team operates, what tools it uses, what data it handles and how it communicates should include a consideration of the associated risks.

Qualitative Versus Quantitative Risk Assessment

Risk assessments can be conducted using qualitative or quantitative approaches, or a combination of both.

• Qualitative assessment: uses descriptive scales (low, medium, high or similar) to express likelihood and impact, and relies on the knowledge and judgement of the assessment team rather than precise numerical data. Qualitative assessments are faster, less data-intensive and more accessible to non-technical participants. They are appropriate for initial assessments, for organisations without extensive historical incident data and for contexts where the primary goal is to identify the most significant risks and prioritise attention.
• Quantitative assessment: uses numerical values to express likelihood (as a probability or frequency) and impact (as a financial cost or other measurable consequence). Quantitative assessments require more data and expertise but produce outputs that can be directly compared with the cost of controls, enabling more precise cost-benefit analysis. Frameworks such as FAIR (Factor Analysis of Information Risk) provide a structured methodology for quantitative cyber risk assessment.

For most management contexts, a qualitative approach is the most practical starting point. The goal is not to produce a precise financial figure for each risk but to develop a shared, structured understanding of where the organisation is most exposed and what should be done about it.

The Manager’s Contribution to Risk Assessment

When your organisation conducts a risk assessment of the systems and processes your team uses, your contribution as a manager is invaluable and often irreplaceable. You can provide:

• An accurate description of how your team actually works, which may differ significantly from how it is documented on paper
• Identification of data your team handles that may not be fully captured in asset inventories
• Knowledge of tools and applications your team uses, including those that have not been formally approved
• Insight into the pressures and time constraints that influence your team’s behaviour around security procedures
• Information about third parties, suppliers and contractors that interact with your team’s systems and data
• Assessment of your team’s current level of security awareness and the likely effectiveness of existing controls

A risk assessment conducted without this kind of management input is likely to produce an incomplete and potentially misleading picture of the organisation’s actual risk exposure.