What Is a Cybersecurity Risk Assessment (and What Should It Cost)?
A cybersecurity risk assessment is a structured review of a business's systems, data, people and processes that identifies the threats it faces, how likely each one is, and the business impact if it happened. The result is a prioritised list of risks and a practical plan to reduce them. It's the most cost-effective first step in cybersecurity, because it shows you where to spend before you spend.
What a risk assessment covers
| Area | Examples of what's reviewed |
|---|---|
| Accounts and access | MFA coverage, admin rights, leavers' accounts, shared passwords |
| Email and collaboration | Phishing protection, domain authentication (SPF/DKIM/DMARC), external sharing |
| Devices | Updates, encryption, endpoint protection, unmanaged personal devices |
| Cloud and SaaS | Microsoft 365, Google Workspace, AWS/Azure configuration, third-party app access |
| Network and website | Exposed services, remote access, website and CMS security |
| Data | Where sensitive data lives, who can reach it, backups, retention |
| People and process | Training, payment verification procedures, incident response plan |
| Suppliers | Which vendors hold your data or have access to your systems |
| Compliance | Obligations under laws such as the NDPA or UK GDPR, and client or industry requirements |
The six steps
- Scope. Agree which systems, sites and data are included.
- Discover. Interviews, configuration reviews and automated scans build a picture of what you have.
- Identify threats and weaknesses. What could go wrong, and where are the gaps?
- Rate each risk by likelihood and business impact (financial, operational, legal, reputational).
- Prioritise. Rank the fixes by risk reduction per unit of effort.
- Report and plan. A plain-English report and a roadmap: quick wins, 90-day actions and longer-term improvements.
What you should receive
- An executive summary a non-technical leader can act on
- A risk register: each risk, its rating, and its owner
- Prioritised recommendations with effort and cost estimates
- Technical detail for whoever will implement the fixes
- A read-out session to walk through it and answer questions
Risk assessment vs vulnerability scan vs penetration test
| What it answers | Depth | |
|---|---|---|
| Risk assessment | "Where is our business most exposed, and what should we fix first?" | Broad: technology, people, process |
| Vulnerability scan | "Which known weaknesses exist in these systems?" | Automated, technical |
| Penetration test | "Could an attacker actually break in, and how far could they get?" | Deep, manual, targeted |
Most growing businesses should start with a risk assessment and use scans and penetration tests where the assessment shows they're needed.
What affects the cost
- Number of users, devices and locations
- Number of cloud services and applications in scope
- Whether technical testing (scans or penetration testing) is included
- Compliance requirements that need mapping
- One-off assessment vs ongoing programme
Eleova pricing: risk assessments for businesses with up to 25 staff start from $499. Microsoft 365 / Google Workspace hardening starts from $399, and managed security support from $249 a month. All prices in US dollars.
Frequently asked questions
How long does a cybersecurity risk assessment take?
For a small or mid-sized business, typically one to four weeks from kick-off to final report, depending on scope and how quickly information and access can be provided.
How often should we do a risk assessment?
At least once a year, and after major changes such as moving to the cloud, opening new offices, a merger, or a security incident.
Will the assessment disrupt our operations?
Very little. Most of the work is interviews and configuration reviews. Any technical scanning is scheduled to avoid business-critical times.
Do we need a risk assessment to comply with the NDPA?
The NDPA requires appropriate technical and organisational measures to protect personal data. A risk assessment is the standard way to decide what "appropriate" means for your business and to show you've considered it.