Cyber
Cyber Risk Assessment
What This Template Is
The Cyber Risk Assessment template provides a structured framework for assessing an organization's cybersecurity risk posture. It covers threat identification, vulnerability assessment, control evaluation, and residual risk calculation — aligned with NIST CSF, ISO 27001, and CIS Controls.
Who Should Use It
Cyber governance leaders assessing organizational cyber risk
CISOs and security teams evaluating cyber posture
Risk managers integrating cyber risk into the enterprise risk register
Compliance officers managing cyber regulatory requirements
What It Contains
Threat identification: threat actors, attack vectors, threat landscape relevant to the organization
Vulnerability assessment: identified vulnerabilities, severity ratings, exploitability
Asset inventory: critical assets, data classification, asset criticality
Control evaluation: existing security controls mapped to NIST CSF / ISO 27001 / CIS, with effectiveness ratings
Inherent and residual cyber risk scoring: impact and likelihood before and after controls
Gap analysis: control gaps against framework requirements, with remediation priorities
Incident history: past incidents, root causes, lessons learned, and remediation status
When to Use It
- When establishing a cyber risk baseline for the organization
- During annual cyber risk assessments and framework alignment reviews
- After a security incident to reassess posture and control effectiveness
- For board reporting on cyber risk and regulatory compliance
How to Use It
1
Create a cyber risk assessment from the template within the Cyber Governance module
2
Identify threats, vulnerabilities, and critical assets relevant to your environment
3
Evaluate existing controls against NIST CSF / ISO 27001 / CIS, rating effectiveness
4
Review the calculated residual cyber risk and compare to your cyber risk appetite
5
Prioritize remediation for control gaps and high residual risks, and report to the board