Cybersecurity Risk Assessment Checklist for small and Medium-Sized Businesses

A 2019 joint report by the Ponemon Institute and Keeper Security found 63 percent of small and medium businesses (SMBs) experienced a data breach in the previous year. With fewer resources to recover from the impact of an attack, SMBs face a higher likelihood of shut down due to a cyber attack than large businesses. Consequently, SMBs must understand how to conduct a risk assessment using limited resources.

This article discusses the essential components of a cybersecurity risk assessment checklist for small and medium-sized businesses to protect themselves from hackers and cyberattacks.

What Is a Risk Assessment?

The National Institute of Standards and Technology (NIST) defines a risk assessment as The process of identifying risks to agency operations (including mission, functions, image, or reputation), agency assets, or individuals by determining the probability of occurrence, the resulting impact, and additional security controls that would mitigate this impact. In other words, a risk assessment looks at your assets and operations and analyzes how a cyber incident could affect them. For instance, if your company gets hit with a ransomware attack that shuts down your customer platform, what would be the cost to operation and revenue? Risk assessments help companies determine if their current controls and processes are sufficient to protect and mitigate against potential threats.

Benefits of Conducting Yearly Risk Assessment:

SMBs often have a more immediate mindset due to their limited resources, both monetarily and in terms of manpower. However, that mindset endangers operations and can leave SMBs more vulnerable to cyber-attacks. Conducting a risk assessment helps curb this potentially negative mindset, improve allocations of resources, and anticipate potential roadblocks in the future. Below are just a few more of the many benefits of a risk assessment.

Better preparation for unexpected events
Increased competitive posture in your industry
A transparent process to address weak points in your system
Improved ability to adapt as the threat landscape changes
Better prepared to fulfill compliance mandates (NERC CIP, CMMC, FedRAMP)

Types of Risk

In general, there are six types of risks every company should consider when choosing a risk assessment framework or methodology.

Strategic – Strategic refers to the factors that pose a threat to your company’s objectives.
Compliance – Each industry has different regulations and standards required to operate and, in many cases, to protect consumer information.
Operational – Determining what factors could slow or halt operations.
Financial – Analyzing your transactions, investments, or business structure to see if they pose a threat to the stability or longevity of your company.
Environmental – If your business is located in an area prone to natural disasters, it is a good idea to develop a disaster response plan and consider the potential impact on your operation should such an event occur.
Reputational – Is your company heavily reliant on a brand image or a specific cause? If yes, you need to conduct an assessment or at least an informal brainstorming session on how a loss of reputation could affect company revenue and industry standing.

Cybersecurity Risk Assessment Checklist

Time and money pose two significant problems for SMBs that want to conduct risk assessments. They worry the time it takes to organize and conduct the risk assessment will take away from the time needed to oversee daily operations. However, if SMBs use a fluid, more flexible approach to risk assessments and leverage the free options available. In that case, they can successfully complete a risk assessment with a reduced impact on operations. The following steps and critical questions provide a loose framework for planning and executing your risk assessment.

Request a Free Consultation

Step 1: Form a Team

When conducting risk assessments, SMBs typically want to avoid high costs. By using an internal team, companies can save a significant amount of money. However, in many cases, SMBs may not have the knowledge base to conduct a thorough and informative risk assessment. This is where a consultant, like RSI Security, may help and provide guidance throughout the process. It is also essential to draw up a team with members from more than just your IT/cyber department. Remediating vulnerabilities will require a multi-department effort.

Step 2: Choose a Framework

Many frameworks, including CMMC, NIST CSF, C2M2, and NERC CIP, serve as a helpful resource when conducting a risk assessment because they call out specific categories auditors may look at. However, they are often more granular than the general risk assessment structure of identifying assets, identifying threats to assets, and identifying vulnerabilities. Using a framework, like those above, in conjunction with risk assessment methodologies, assessment teams will know what tools or categories to test for potential vulnerabilities. For example, if your company stores large amounts of consumer PII, a potential risk would be the exploitation of that data. Exploitation is more likely to occur if you do not encrypt your data in motion, in use, and at rest, a concern noted in both the CMMC and NIST frameworks.

Step 3: Identify and Rank Risks

To identify threats and rank them, you need to determine the relevancy and likelihood of the threats. For example, would a supply chain threat, direct malware attack, or insider threat cause greater damage, and what is the probability of each? Likewise, if a hack occurs, what type of hack (e.g., denial of service, ransomware, malicious program injection) could cause the most significant impact? Once you determine the risks, rank them by impact and likelihood. Then, assess what measures you have to mitigate those risks and if vulnerabilities, or gaps, exist within your cybersecurity environment. For example, do employees receive training on identifying insider threats, or do you utilize a vulnerability scanner or anti-malware solution?

Step 4: Establish a Baseline

Once you understand your strengths and weaknesses, establish a baseline using cybersecurity best practices tailored to address your previously identified high, medium, and low risks. Using one of the frameworks appropriate to your industry is an excellent place to start since they are well established and based on industry standards. However, you are not limited by the baseline; rather, it serves as a building block. For example, CMMC Level 1 only requires 17 practices for compliance. Still, if a company grows and begins receiving or creating Controlled Unclassified Information (CUI), the company will be expected to achieve a minimum Level 3 certification. Baselines change, but conducting a risk assessment helps you see what needs to change within that baseline as your company evolves.

7 Key Questions to Ask When Conducting a Risk Assessment:

What are my company’s goals?
What factors could affect my business?
What are the highest threats?
How can my company mitigate those threats in advance?
Did mitigation/control efforts produce the expected results?
Who needs to be contacted/made aware of issues?
What do we need to adjust/improve?

Risk Assessment Goals

Throughout a risk assessment, experts recommend companies strive to achieve the following goals:

- Objectivity – Do not make assumptions or take someone’s word that specific controls are in place. Go through every step of the framework you choose and have your team verify the fulfillment of requirements.
- Risk identification – It’s often a good idea to use several different risk identification methodologies, as each one will use a slightly different approach and thus provide further insights.
- Prioritization – Do not treat all threats and weaknesses equally. Some threats require immediate action because, if exploited, the impact would be significantly worse than a lower-ranked threat. Risk ranking ensures the remediation team tackles the most critical vulnerabilities first.
- Comprehensive Incident Response (IR) Plan – Being prepared when a threat manifests means having an action plan or an incident response plan. The threat can be identified and mitigated as soon as possible. The goal is to minimize operational, reputational, and monetary impact.
- Remediation implementation – Once your threats are prioritized, you should create a remediation plan with deadlines to ensure the weaknesses are addressed and not simply forgotten once the assessment is complete.
- Reporting – In the event of an incident, what stakeholders need to be notified? Ensure employees receive training on how to respond to an incident, including who to contact and what immediate action should be taken. Reporting can also refer to oversight bodies within your industry, so be sure to check if such requirements exist.
- Review – Whenever you complete a risk assessment, you should always review the results and determine areas of improvement for your systems and the flow of the risk assessment process itself.

How to Reduce the Cost of Assessment and Compliance

Although companies should be conducting risk assessments for the sake of securing their systems and protecting their information, the reality is many companies do risk assessments only because regulations or a compliance framework requires it. One of the big reasons SMBs hesitate to perform these assessments is the time, money, and human resources needed, so here are some tips on reducing costs.

Internal Support

A risk assessment is not a one-and-done task; it requires planning and follow-through. Once an assessment is completed, the remediation phase will occur, which usually requires cooperation between departments. Additionally, many cybersecurity regulations require risk assessments yearly. Having a designated compliance team or, for smaller businesses, just a single employee in charge of keeping track of risk assessment progress, deadlines, and any other actions will reduce the need to use outside help. Having someone knowledgeable within your company gives employees a resource if they have any compliance questions and ensures your company stays up-to-date on any changes in compliance requirements.

Don’t Get Stuck in the Present

Doing just enough to get by is not a good strategy when it comes to cybersecurity and compliance. Just because your company is small in the present doesn’t mean it won’t grow. For example, what tools are you using now, and are they scalable? When you look for security tool solutions, look for options that provide scalability at an affordable rate. If your company grows and the system is overly taxed or not secure enough to handle the information you hold, you are putting your company at greater risk.

Continuously Monitor

Imagine waiting until your car completely breaks down before taking it to a repair shop versus getting your vehicle serviced regularly. If you wait until there are no options, it costs more, takes more time to fix, and leaves you without a car (i.e., inhibiting productivity). Cybersecurity follows the same concept and experts recommend that systems are continuously monitored and reviewed for potential failures, suspicious activity, or potential areas for improvement.

Use Automated Tools

For SMBs with limited resources, allocating employees for cybersecurity monitoring may seem daunting, even more so creating a dedicated team. But by leveraging automated tools, fewer people will be required to perform mundane tasks. However, this does not mean companies should understaff their cybersecurity or IT division. As your company grows and your system becomes more complex, using automated tools will allow for greater scalability and lower the chances of overlooking specific systems due to a shortage of staffing. System monitoring can be outsourced if a company does not have the employees with the necessary knowledge base; however, as your company grows, it would be prudent to develop an internal cyber team to work with your compliance department and manage your overall security posture.

In Summary

SMBs sometimes see risk assessments as an additional burden with no value; however, the reality is that risk assessments are an investment. The long-term improved security infrastructure and competitive industry posture balance out the short-term, up-front cost of the risk assessment. Moreover, conducting a risk assessment increases the longevity of a company because it is future thinking and better able to adapt in the face of industry or cyber threats. If you are interested in risk assessment support, contact RSI Security today for a consultation.