Risk assessment
Not all risks are equal, and what matters is knowing which to tackle first. The assessment turns worry into a concrete, prioritised list.
Built for ISO 27001NIS2 DORA
- Asset inventory
- Threat identification
- Impact assessment
From general worry to a concrete list
A risk assessment turns vague worry into a concrete list: what can happen, how likely it is, how much it would cost and what can be done about it.
It is the foundation that both NIS2 and DORA require, and in any case it helps you allocate your security budget sensibly. With a risk register, you make decisions based on numbers, not on whichever threat last made the news.
How the assessment works
Six steps from an asset list to an action plan you can start executing.
Asset inventory
Threat identification
Impact assessment
Risk register
Treatment plan
Supplier risks
Report to management
Periodic review
Frequently asked questions (FAQ)
How does a risk assessment differ from a security audit?
An audit checks how what you already have works. A risk assessment looks wider: which scenarios could harm the business at all, how likely they are and what the losses would be. In practice they complement each other: the audit provides the facts, and the assessment sets the priorities.
Do NIS2 and DORA require a risk assessment?
Yes. Both regulations rely on a risk-based approach, and a documented risk assessment is one of the first things requested when you demonstrate compliance. It is also the basis for deciding which measures you really need.
Who needs to take part on our side?
Usually one person who knows the IT infrastructure and one who knows the business processes. The most valuable information often comes not from IT but from those who know what would happen to the business if a particular system stopped.
How often should the assessment be repeated?
Usually once a year, and also after significant changes such as a new system, business expansion or a serious incident. Between reviews it is enough to update the register rather than repeat the whole process.
Related services
Virtual CISO solution:
MDP CLOUD vCISO is an experienced chief information security officer (CISO) on demand: risk management, policies, control implementation, training…
DORA implementation from A to Z
We will help you implement DORA, from policies to deploying security solutions.
Expertise confirmed by certifications
This service is delivered by specialists with valid international certifications. Their expertise is confirmed by independent organisations, not by us.
-
Certified in Risk and Information Systems Control
Risks are assessed and controlled using the international IT risk methodology.
-
Certified Information Systems Auditor
Audit and evidence in line with international information systems audit standards.
-
ISACA Advanced in AI Risk
AI risks are identified and managed like any other IT risk.
Order a risk assessment
We reply within 1 business day