October 2026. The risk assessment is the heart of ISO 27001 and NIS2, and for many SMEs the part that takes longest. It can be simpler. The standard prescribes no method, only that your approach is consistent and repeatable. More background at risk assessment.
Step 1: set scope and criteria
Record which parts of the organisation take part and define your likelihood and impact scales up front, for example 1 to 4. Also decide which risk level you accept. Without these criteria every outcome is arguable.
Step 2: inventory what you want to protect
List your most important assets: systems, data types, suppliers and processes. Start with the ten to twenty that hit the business directly if they fail or leak. You do not need to describe every laptop.
Step 3: name threats and vulnerabilities
Link realistic scenarios to each asset: ransomware, account takeover, a cloud supplier outage, human error. Use an existing list as a starting point, such as the threats behind Annex A, and drop what does not fit.
Step 4: rate and decide treatment
Give each scenario a likelihood and impact score and calculate the risk level. Choose per risk: reduce (control), accept, avoid or transfer (for example insure). Map the chosen measures to Annex A controls; that later feeds your Statement of Applicability.
Step 5: have risk owners accept, then repeat
A risk owner signs for the residual risk. Record the acceptance and discuss the outcome in the management review. Repeat the assessment at least annually and after major changes, such as a new supplier or a new AI tool.
Common mistakes
Too many risks (hundreds of rows nobody maintains), scores without rationale, and measures without an owner or due date. Keep the register small and alive. To see how your current approach scores, take the readiness scan.