Small business cybersecurity risk assessment in one hour

"Risk assessment" sounds like something only big companies with security teams do, but for a small business it comes down to three questions: what do we rely on, what could go wrong, and what should we fix first?

This guide walks you through a simple self-assessment you can finish in about an hour with a coffee and a notepad. You'll end up with a short, ranked to-do list instead of a vague worry.

What is a cybersecurity risk assessment?

A cybersecurity risk assessment is a structured way to decide where to spend your limited time and money. Instead of trying to fix everything, you find the few things that would hurt most and make them less likely.

CISA's Cyber Essentials puts it simply: approach cyber as a business risk. You already do this for fire, theft and liability. This is the same thinking applied to email, devices and data.

You don't need technical knowledge for most of it. You need to know how your business runs, and you already do.

Before you start, block out an hour, grab a spreadsheet or a sheet of paper, and if you have one, invite the person who handles your IT or website. Your next step is to set up three columns: "What we have," "What could go wrong," and "Score."

Step 1: What does your business rely on?

Spend about 15 minutes listing everything your business uses that's connected to the internet or holds important information. CISA recommends keeping an inventory of hardware, software and accounts so you know what's in play.

Use these six categories as prompts:

For each account, note who has access and whether multi-factor authentication (MFA) is on. For each vendor, note what they can see or touch. This list is valuable on its own, even before you score anything.

Before moving on, circle the three items that would stop your business from working if they disappeared tomorrow.

Step 2: What could go wrong?

Now spend about 10 minutes going through your list and asking, "What's the realistic bad day here?" Focus on common problems rather than movie-style hacks.

These are the risks that show up again and again for small businesses:

• Email takeover: someone steals a password and reads or sends email as you.
• Fake payment requests: a scammer impersonates you, a vendor or a client and asks for money to go to a new account. This is called business email compromise.
• Email impersonation: criminals send emails that look like they come from your domain to trick your customers.
• Ransomware: malicious software locks your files until you pay.
• Lost or stolen device: a laptop or phone with customer data goes missing.
• Website problems: an expired certificate, a hacked plugin, or a defaced homepage.
• Domain expiry: your domain lapses and your website and email stop working.
• Leftover access: a former employee or old contractor can still log in.
• Vendor breach: a company you trust with your data gets breached.

Write each relevant risk next to the item on your list it affects. One item can have more than one risk.

Your next step: cross off any risk that doesn't apply to you, and add any that are specific to your industry.

Step 3: How likely is it, and how bad would it be?

This is the step that turns worry into priorities. For each risk, give it two quick scores from 1 to 3. Don't overthink it. Your gut feeling is good enough for a first pass.

Likelihood: 1 = unlikely, 2 = possible, 3 = likely or has happened before.

Impact: 1 = minor annoyance, 2 = costly or disruptive for a few days, 3 = serious harm to money, customers or reputation.

Multiply the two to get a score from 1 to 9. Here's what a typical small business might come up with:

Your numbers will be different, and that's the point. A bakery with no online orders will score website risks lower than an online shop. A law firm handling client funds will score payment fraud higher.

Notice that adding a safeguard lowers the likelihood. Once MFA is on, email takeover might drop from a 3 to a 1, which takes its score from 9 to 3. You'll use this when you plan.

Now sort your list from highest score to lowest.

Check the outside-facing part of your risk list

Our free scan checks what anyone on the internet can see: HTTPS, your certificate, security headers, and your email and domain records. It covers the website, email and domain rows of your assessment.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

Step 4: What should you fix first?

Start at the top of your sorted list. Anything scoring 7 to 9 deserves attention in the next few weeks. Scores of 4 to 6 belong in your plan for the next few months. Scores of 1 to 3 can usually wait, as long as you check on them.

For each high-scoring risk, pick the simplest safeguard that lowers its likelihood or its impact:

• Protect against email takeover with MFA on every mailbox and a password manager.
• Counter fake payment requests with a rule that any change to bank details is confirmed by phone using a number you already have.
• Make email impersonation harder by publishing SPF, DKIM and DMARC records. See how to stop email spoofing.
• Against ransomware, turn on automatic updates and keep at least one backup that isn't connected to your network. Test restoring from it.
• Clear out leftover access by reviewing every account list and removing people who no longer need it.
• In case a device goes missing, turn on device encryption and automatic screen lock.
• For website issues, fix anything flagged in a security scan, and follow our small business cybersecurity checklist.

Some fixes lower several risks at once. MFA, for example, helps with email takeover, payment fraud and leftover access. Those are worth doing first.

A free outside-in scan is a useful check on the website, email and domain rows. It can't see inside your computers, accounts or backups, so those rows rely on your own review.

Your next step: for each of your top three risks, write down one specific action and who will do it.

Step 5: How do you turn this into a plan?

A plan doesn't need to be long. One page is plenty. For each action, write down four things: what you'll do, who owns it, when it'll be done, and how you'll know it worked.

Add a short section on what you'd do if something goes wrong. List who to call (your IT helper, web host, bank and insurer) and where to report fraud, such as your bank and the FBI's IC3. Print it. On a bad day, you may not have access to your computer.

Then put a reminder in your calendar to revisit this assessment in a year, or sooner if something big changes.

Share the one-page plan with anyone who's named as an owner.

How does this map to the NIST Cybersecurity Framework?

If you've heard of the NIST Cybersecurity Framework (CSF), you've just done a lightweight version of it. CSF 2.0 organizes cybersecurity into six functions, and NIST's Small Business Quick-Start Guide is written for businesses with modest or no cybersecurity plans in place.

Here's how the framework's six functions line up with what you just did, in plain English:

You don't have to use the framework's language with your team. It helps to know that this simple process follows a free government framework that many organizations use. The FTC's Cybersecurity for Small Business pages also describe the framework and give practical steps for each part.

Your next step: if any function has nothing next to it, add one small action for it to your plan.

What should you do next?

You've done the hard part by thinking it through. Now take the first small actions while the list is fresh.

1. Run the free website security scan to fill in the website, email and domain rows with real results. To see what you'll get first, look at the example report or what we check.
2. Work through the small business cybersecurity checklist for your top-scoring areas.
3. If email impersonation scored high, check your domain with the DMARC checker.
4. Book a calendar reminder to repeat this assessment next year.