Cybersecurity can feel too broad to begin. A risk assessment makes it concrete: what systems matter, what could happen, how exposed they are, and what action is worth taking first. The result should be a prioritised plan, not a long document that no one uses.
Inventory the business before the threats
List identities, devices, applications, data, vendors, locations, and internet connections. Identify which services would stop work if unavailable and who owns each one.
- Include cloud accounts and third-party services.
- Mark critical dependencies and single points of failure.
- Record administrator ownership and recovery contacts.
Consider likely paths to impact
Review phishing, weak credentials, unpatched devices, exposed remote access, lost hardware, supplier access, and backup gaps. Rank each risk by business impact and likelihood rather than trying to fix everything at once.
- Protect identity and administrator accounts.
- Patch supported systems and remove stale access.
- Keep tested, protected backups.
Turn findings into a short roadmap
Microsoft’s small-business guidance emphasises risk assessment, updates, backups, encryption, and awareness. Digital Allo’s cybersecurity support can help a Surrey business convert findings into practical next steps and recurring reviews.
- Assign an owner and date to each action.
- Track exceptions and accepted risk.
- Reassess after major business or technology changes.
A one-page risk register
Score each risk from 1 (low) to 3 (high) for how likely it is and how much harm it would cause. Multiply the two and work on the highest totals first.
| Risk | Likelihood | Impact | Score | First action |
|---|---|---|---|---|
| Staff email account taken over by phishing | 3 | 3 | 9 | Multi-factor authentication for all users |
| Ransomware encrypts shared files | 2 | 3 | 6 | Offline or protected backup with a tested restore |
| Lost or stolen laptop | 2 | 2 | 4 | Device encryption and remote wipe |
| Former employee still has access | 2 | 2 | 4 | Leaver checklist and quarterly access review |
| Supplier with remote access is compromised | 1 | 3 | 3 | Limit and log supplier access |
The scores in this table are examples. Your own scores depend on your systems, data and how you work.
Five questions to answer this week
- Who has administrator access to email, files, the website and banking?
- Is multi-factor authentication on for every account that supports it?
- When was a backup last restored successfully?
- Which devices are no longer receiving security updates?
- Who would you call first if something went wrong tonight?
Use a recognised baseline
The Canadian Centre for Cyber Security publishes baseline controls written for small and medium organisations. Using them as a checklist keeps the assessment practical and helps you explain priorities to staff, insurers and customers.
A practical starting point
- Start with the systems that stop revenue.
- Secure identity and recovery first.
- Use a roadmap that staff can act on.
Frequently asked questions
Do we need a formal audit?
That depends on your industry, contracts, and risk. A basic assessment is a useful start, but regulated or high-risk organisations may need specialist assurance.
How often should we reassess?
Review after major changes and on a regular cadence appropriate to your risk and resources.
Will a risk assessment help with cyber insurance?
Insurers increasingly ask about controls such as multi-factor authentication, backups and patching. A current assessment makes those questions easier to answer accurately.
Further reading
- Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations
- Canadian Centre for Cyber Security: Top 10 IT security actions
- Microsoft: Cybersecurity for small businesses
How Digital Allo can help
Digital Allo runs practical cybersecurity assessments for Surrey businesses and turns the findings into a short, prioritised plan. Book an assessment to see where to start.
