Advanced level · Module 1: Security Governance and Risk Management · Lesson 3 of 4
Assessing Cyber Risk
Identify and rate risks by likelihood and impact on the mission.
In this lesson you will
- Identify threats, vulnerabilities and impacts
- Rate and record risks
Key concepts
assetsthreats and vulnerabilitieslikelihood and impactrisk register
The lesson
Risk combines how likely something is and how much harm it would cause. Start from critical assets and processes: payroll, beneficiary data, donor reporting, email.
For each, ask what could go wrong (ransomware, account takeover, data leak, loss of a laptop) and what weaknesses make it more likely.
Record risks in a register with a rating, owner and treatment — reduce, transfer, avoid or accept.
Step by step
- List critical assets.
- Identify risks for each.
- Rate likelihood and impact from 1 to 5.
- Assign owners and treatments.
A small NGO's top cyber risks
Rating risks by likelihood and impact shows where to invest first.
| Risk | Likelihood | Impact | Score | Treatment |
|---|---|---|---|---|
| Ransomware via phishing | 4 | 5 | 20 | Reduce: MFA, offline backups, awareness |
| Shared admin password | 4 | 4 | 16 | Reduce: named admin accounts |
| Laptop theft in the field | 3 | 4 | 12 | Reduce: encryption, remote wipe |
| Unpatched office router | 3 | 3 | 9 | Reduce: firmware updates |
| Website defacement | 2 | 2 | 4 | Accept, with backups of the site |
What the data shows
Ransomware scores 20 of 25: it is likely and could stop payroll and donor reporting. The shared admin password (16) makes it worse, because one stolen password unlocks everything.
Website defacement is low on both scales; with a backup of the site, the NGO can accept it and spend its limited budget elsewhere.
Recommendation
Fund MFA, tested offline backups and separate admin accounts first; together they reduce the top two risks at low cost.
Practice activity
Build the case NGO's risk register.
Expected result: A register with rated, owned risks and treatments.
Check your understanding
-
What two factors make up risk?
Show answer
Likelihood and impact.
-
Name the four risk treatments.
Show answer
Reduce, transfer, avoid or accept.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.