What is a risk assessment?
A risk assessment is the structured process of finding the risks an organization faces and judging how serious each one is. It looks at what the organization has to protect, what could harm it, which weaknesses could be used, how likely each harmful event is and how bad it would be. The output is a ranked list of risks that leadership can act on, usually recorded in a risk register. An assessment doesn't fix anything itself; it shows where money and effort should go.
The building blocks
- Assets: systems, data, people, facilities and services, valued by what they mean to the business.
- Threats: who or what could cause harm, from ransomware groups and insiders to storms and failed suppliers.
- Vulnerabilities: weaknesses a threat could exploit, such as unpatched software, missing MFA or a single network link.
- Likelihood: how probable the event is over a set period, usually a year.
- Impact: the harm if it happens, in money, downtime, legal exposure, reputation or safety.
- Existing controls: what already lowers likelihood or impact, counted only if it actually works.
A risk is the combination: a threat exploiting a vulnerability against an asset, weighed by likelihood and impact.
How an assessment is carried out
NIST SP 800-30 sets out a widely used method in four steps: prepare by fixing the scope and rating scales; conduct the assessment by identifying threats and vulnerabilities and determining likelihood, impact and risk; communicate the results to decision makers; and maintain the assessment as conditions change. ISO 31000 describes risk assessment as identification, analysis and evaluation, where evaluation compares each result with the organization's criteria to decide whether it needs treatment.
Ratings can be qualitative, such as low to critical on a likelihood and impact matrix, or quantitative, in dollars per year. Many programs rate everything qualitatively and work out dollar figures only for the risks that drive a spending decision.
Assessments also differ in timing. A one-time assessment supports a specific decision, such as an acquisition or a new system. An ad hoc assessment responds to an event, such as a newly disclosed threat or a major incident. Recurring assessments run on a calendar, often yearly, and continuous assessment uses automated monitoring to keep ratings current between formal reviews.
Example: assessing a new patient portal
Before a clinic launches a patient portal, its security lead assesses it. The asset is the portal and the health records behind it. One threat is credential stuffing, and the vulnerability is that patients sign in with a password alone. Because breached passwords are easy to find, likelihood is rated likely. Impact is rated severe, since exposed records would trigger breach notification and regulatory scrutiny. The high result goes into the risk register with the practice manager as risk owner, and the recommended treatment is MFA plus rate limiting on the login page before launch.
Risk assessment vs. related activities
- Vulnerability assessment: finds and rates technical weaknesses, often with a scanner and CVSS scores. It feeds a risk assessment but ignores what the system means to the business.
- Business impact analysis: measures how harm grows when a function stops, whatever the cause. The risk assessment asks what could stop it and how likely that is.
- Penetration test: shows whether weaknesses can actually be exploited.
- Audit: checks whether controls meet a standard or requirement.
Risk assessment on the CompTIA Security+ exam
Risk assessment is part of SY0-801 objective 5.2, which covers the risk management process: identifying risks, assessing and analyzing them, and choosing treatments. Expect scenarios that describe the activity rather than name it, such as listing assets and threats, rating likelihood and impact, or scoring risks on a heat map. If a question asks what to do first, identifying assets comes before scoring risks or buying controls. A common trap offers a vulnerability scan or a CVSS score as the risk assessment; those rate technical severity, not risk to the business.