Cybersecurity Risk Assessment

What a cybersecurity risk assessment covers

A cybersecurity risk assessment answers three questions in writing: what do we have, what could go wrong, and what should we fix first. It ranks risks by likelihood and impact so money goes to the weaknesses most likely to hurt the business.

A security risk assessment for a 10 to 250 person company usually covers:

• Assets and data. Computers, servers, phones, network gear, cloud apps, and where client, patient or financial data sits.
• Identity and access. Who has admin rights, whether multi-factor authentication covers email, remote access and finance systems, and how departing staff are removed.
• Vulnerabilities. Missing patches, unsupported systems and exposed services, found with internal and external scans.
• Email and endpoints. Filtering, endpoint protection and detection coverage.
• Backups and recovery. Whether backups are separate from the network, encrypted and restore-tested.
• Vendors. Which outside companies hold your data or have remote access. Third parties were involved in 48% of breaches in the 2026 Verizon DBIR ⁹.
• People and process. Training, incident response plans and written policies.

Terms vary by seller. An IT risk assessment or IT security assessment usually means the same thing. A network security assessment narrows the focus to firewalls, Wi-Fi, switches, remote access and scans. A cybersecurity audit checks controls against a fixed standard and records pass or fail. A penetration test is narrower and deeper: testers try to break in to prove which weaknesses are exploitable. Most small businesses should start with an assessment and add a test once the obvious gaps are closed.

Frameworks used: NIST CSF 2.0 and the rules you answer to

Most assessments for small and midsize businesses are scored against the NIST Cybersecurity Framework (CSF) 2.0, released February 26, 2024 ¹. CSF 2.0 has six functions ¹:

1. Govern: roles, policy and oversight. New in version 2.0 ¹.
2. Identify: assets, data and risks.
3. Protect: access control, training, data security, patching.
4. Detect: monitoring and alerting.
5. Respond: incident handling.
6. Recover: restoring operations.

NIST says CSF 2.0 is meant for organizations of every size, "from the smallest schools and nonprofits to the largest agencies and corporations," and publishes quick-start guides, including one for small businesses ¹. CISA's Cross-Sector Cybersecurity Performance Goals offer a shorter list of baseline practices intended in part to help small and midsize organizations start, aligned to the CSF functions ².

If a regulation applies, the assessment should be measured against it as well:

• Healthcare: the HIPAA Security Rule requires an accurate and thorough risk analysis of electronic protected health information ³. See HIPAA compliance services.
• Tax preparers, lenders, dealers: the FTC Safeguards Rule requires a written risk assessment for firms with customer information on 5,000 or more consumers ⁴. See written information security plans.
• Defense contractors: NIST SP 800-171 Rev 2 is the yardstick, with self-assessment scores posted in SPRS ⁶. See NIST 800-171.
• New York financial firms: 23 NYCRR Part 500 requires a risk assessment even for firms with the limited small-entity exemption ⁷.

What you should receive

A cybersecurity risk assessment should end with documents you can act on and show to others. Ask for these before you sign:

• Executive summary. One or two pages in plain language: top risks, what they could cost the business, and what to do first.
• Asset and data inventory. The list the assessor built. Keep it; most rules and insurers ask for one.
• Findings with ratings. Each issue with a likelihood and impact rating, the evidence behind it and the systems affected.
• Framework scorecard. Where you stand on each NIST CSF 2.0 function ¹, or against the specific rule that applies to you.
• Prioritized remediation plan. Fixes in order, with rough effort, owner and target date. Quick wins (MFA gaps, exposed remote desktop, untested backups) should be at the top.
• Raw scan output as an appendix, so your IT provider can work through it.

Red flags: a report that is only scanner output, findings with no ratings, a fix list that matches the seller's product catalog line for line, or no named person to walk you through the results.

If the firm assessing you also runs your IT, ask how it reviews its own work. A reasonable pattern is an independent assessment every year or two, with your managed IT provider owning the fix list in between.

Cybersecurity risk assessment cost

We have not found a neutral published survey of cybersecurity risk assessment prices, so we do not print a range for the assessment itself. Price is driven by the number of sites, users, servers and cloud systems, whether scanning and interviews are included, and whether the result must map to a specific rule.

What we can source are the parts that often sit inside or next to an assessment:

• Penetration testing: two security firms' 2026 guides put small external network tests at about $5,000 to $20,000 ¹¹¹².
• Vulnerability scanning: a self-run scanner license lists at $4,790 a year, and a 100-asset cloud scanning subscription at about $3,700 a year ¹³.
• Ongoing security leadership: one vCISO provider publishes retainers of about $1,500 to $4,000 a month for firms with 1 to 50 employees ¹⁴. See vCISO services.

Some managed IT providers offer a no-cost assessment as a sales step. That can be useful as a first look, but the seller is grading the work it hopes to win. Read the report with that in mind. Compare it against the deliverables list above.

For context on the downside, IBM's 2026 Cost of a Data Breach Report puts the global average breach at $4.99 million ¹⁰. That figure skews toward larger organizations, but small firms are frequent targets: ransomware was present in 48% of breaches in the 2026 DBIR ⁹.

How often to do a risk assessment

Do a full cybersecurity risk assessment at least once a year, and again after any major change: a new office, a cloud migration, a merger, a new line of business or a security incident. Some rules set firmer timing:

Between full assessments, keep scanning. Vulnerability exploitation overtook stolen credentials as the top initial access route in the 2026 DBIR ⁹, and new flaws appear every month. Quarterly or monthly scans, run by your IT provider and reviewed by someone, close most of that gap. If you are switching providers, an assessment also gives the new one a clear baseline; see how to choose an MSP.

How an assessment ties to cyber insurance, HIPAA and CMMC

A current risk assessment does double duty: it is often required by regulators and it backs up the answers you give insurers.

Cyber insurance. Underwriters ask about specific controls. Marsh lists twelve that insurers look for, including MFA for remote and privileged access, EDR, tested and encrypted backups, patch management, incident response plans and logging ¹⁵. Getting those answers wrong can be costly: in Travelers v. International Control Services, the insurer sought to rescind a $1 million cyber policy, alleging the application said MFA protected servers when it only protected the firewall ¹⁶. An assessment checks the facts before you sign the application. See cyber insurance requirements.

HIPAA. The risk analysis is required, and OCR keeps enforcing it. OCR cited a failure to do an accurate and thorough risk analysis in its July 2026 ransomware settlement for $552,250 ⁸. Our HIPAA compliance checklist shows where it fits among the other safeguards.

CMMC and defense work. CMMC Phase 2 third-party certification was suspended on July 13, 2026, and DoD says implementation is paused in Phase 1 with no new Phase 2 date ¹⁷. Self-assessment requirements remain, and DoD says it will enforce NIST SP 800-171 Rev 2 ¹⁷. An assessment against the 110 requirements is how you produce an accurate SPRS score; see CMMC. The schedule may change, so check the DoD CIO site before planning.

If you need help fixing what an assessment finds, our guide to cybersecurity for small business covers the usual first steps.