Insurers, auditors and frameworks all ask for a risk assessment, and most small businesses either have none or have a spreadsheet nobody has opened since it was made. This guide gives you a register that is small enough to maintain, explains how the scoring works and where it stops being meaningful, and walks through a fictional example. It is the natural follow-on to our IT audit checklist, which finds the facts the register scores.
Download (original NetSys template, no registration):
- Download the IT risk assessment template (Excel, .xlsx): a risk register with scoring formulas, a 1 to 5 scales sheet, a heat map, a summary, a review log and eight fictional example rows.
The example rows describe a made-up 25-person firm and no real business.
What is an IT risk assessment?
An IT risk assessment is the exercise of listing what the business depends on, naming the specific things that could go wrong, judging how plausible and how damaging each one is, and deciding what to do about it. The output is a risk register: a table that makes those decisions visible and gives each one an owner. NIST's guide for conducting risk assessments, SP 800-30 Rev. 1, builds on the same two ingredients, likelihood and impact (checked on November 7, 2026); this template is that structure cut down for a business without a risk team.
What columns does the risk register have?
| Column | What goes in it | Why it is there |
|---|---|---|
| Asset or process | Email and files, backups, payroll, laptops, wire transfers, the internet connection | Risks attach to things the business depends on, not to abstractions |
| Threat | Account takeover by phishing, ransomware, lost laptop, carrier outage | Names the event |
| Weakness that makes it plausible | MFA missing on two shared mailboxes; only backup copy on a reachable share | Without a specific weakness the threat is a worry, not a risk |
| Existing control | What is already in place | Scores are judged with current controls, not from zero |
| Likelihood (1 to 5) and Impact (1 to 5) | Whole numbers from the Scales sheet | Ranks the entries |
| Score and Rating | Formulas: likelihood times impact; Low 1 to 6, Medium 8 to 12, High 15 to 25 | Consistent labels |
| Evidence reviewed | The export, screenshot or record you looked at, with a date | An entry without evidence is an opinion |
| Owner | One named person | A risk owned by everyone is owned by no one |
| Decision | Accept, Mitigate, Transfer or Avoid | Forces a choice |
| Planned action, due date, status | What will be done and by when | Turns the register into a plan |
| Residual likelihood, impact and score | The expected position after the action | Shows whether the action is worth it |
How does the 1 to 5 scoring work?
Likelihood asks how plausible the event is in the next 12 months given the controls you have. Impact asks what it would do to the business. Both run from 1 to 5 with a definition for each step on the Scales sheet, from 1 (rare; negligible) to 5 (almost certain; the business cannot operate or faces legal consequences that threaten it). The Score column multiplies the two, and the Rating column labels the product. Because two 1 to 5 numbers can only multiply to a few values, the bands are Low for 1 to 6, Medium for 8 to 12 and High for 15 to 25.
What are the limits of ordinal scoring?
The numbers are ordinal: they put entries in order. They are not measurements. A score of 20 is not twice as likely or twice as costly as a 10, two risks with the same score are not interchangeable, and no score in this register is a probability that a breach will happen. Multiplying two ordinal numbers is a convenience that produces a useful ranking, and nothing more. Treat the register as a planning aid that makes decisions visible and defensible, not as a prediction, and never present a score to an insurer or a regulator as a measured likelihood. If a decision depends on the real cost of an outage, work it out in dollars separately; our guide to recovery time and recovery point objectives covers that side.
A worked example for a fictional 25-person firm
The template ships with eight example rows for a made-up professional services firm with one office, Microsoft 365, a file server, a hosted payroll platform and a handful of older PCs. Four of them, abbreviated:
| ID | Asset and threat | Weakness | L | I | Score | Decision and action |
|---|---|---|---|---|---|---|
| R-01 | Microsoft 365: account takeover by phishing | MFA enforced for staff but not for two shared mailboxes and one service account | 4 | 5 | 20 High | Mitigate: enforce MFA by policy on every account; block sign-in on shared mailboxes. Residual 2 x 5 = 10. |
| R-02 | File server backups: ransomware encrypts server and backup copy | Only backup copy sits on a share user PCs can reach; no restore tested since 2025 | 3 | 5 | 15 High | Mitigate: add an immutable off-site copy; test and time a restore. Residual 2 x 3 = 6. |
| R-05 | Office internet: carrier outage stops phones and cloud apps | Single carrier, no failover; staff can work from home | 3 | 2 | 6 Low | Accept: revisit if an outage passes four hours or when the lease renews. |
| R-08 | Wire transfers: business email compromise redirects a payment | Payment changes accepted by email; no call-back rule | 3 | 5 | 15 High | Mitigate: call-back to a number on file for any bank detail change. Residual 1 x 5 = 5. |
Notice that R-05 is accepted with a written trigger for revisiting it, which is a legitimate decision. Notice also that R-08 keeps its impact of 5 after the fix: a call-back rule makes the event far less likely but would not reduce the loss if it happened anyway. Residual scores are honest when they move only the number the action actually changes.
How do you fill the register in?
- List dependencies. Email and files, line-of-business systems, backups, payments, devices, the internet connection, key vendors, the people who hold the keys.
- Name threats and weaknesses. One row per specific pairing. "Ransomware" alone is not an entry.
- Record controls and evidence. Use the exports and screenshots from your IT audit checklist work, dated.
- Score. Likelihood and impact from the Scales sheet, judged with current controls.
- Decide and assign. Accept, mitigate, transfer or avoid; one owner; a due date; the expected residual score.
- Review. Quarterly, and after an incident, a new system, an office move or a provider change. Log each review.
Accept, mitigate, transfer or avoid: which decision fits?
Accept means the business lives with the risk knowingly, with a written trigger for looking again. Mitigate means reduce likelihood or impact with a control. Transfer means move part of the financial consequence elsewhere, usually through cyber insurance or a contract term, which never removes the operational impact. Avoid means stop doing the thing that creates the risk. Most small business registers are mostly Mitigate with a few honest Accepts; a register with no Accepts is usually not telling the truth about budget.
Where do vendors fit?
Give each important vendor one line in this register (the example's hosted payroll platform is R-04). The detailed work, the questionnaire, the evidence and the exceptions, lives in a separate document built for third parties: our vendor security questionnaire template and vendor risk register. Keeping the two apart stops the general register from filling up with one vendor's paperwork.
How NetSys uses a register
Our IT audit produces the findings and evidence; the register is where those findings become scored decisions with owners, and it is the document we review with clients each quarter. If you want a quick read on where you stand before building one, the cybersecurity self-assessment takes a few minutes and points at the areas to look at first.
Frequently asked questions
What is the difference between an IT risk assessment and an IT audit?
An audit establishes facts: who has admin rights, whether backups restore, which devices are unsupported. A risk assessment judges those facts: how plausible and how damaging each gap is, and what the business will do. The audit feeds the register; the register drives the plan.
Can this serve as a cyber security checklist for a small business?
It works alongside one. A checklist tells you which controls to have; the register records why each gap matters and what you decided. If you want the checklist first, start with our small business cybersecurity checklist, then score the gaps it finds here.
Does a risk register satisfy HIPAA, the FTC Safeguards Rule or cyber insurance questions?
Each of those asks for a risk assessment in its own words, and a maintained register with evidence and dated decisions is the kind of document they expect to see. Whether yours satisfies a specific rule depends on its scope and on the rest of your program, so check the requirement itself and do not treat the template as compliance on its own.
How many rows should a small business register have?
Usually 15 to 40. Fewer than ten suggests the threats are too general; more than fifty suggests the register has become a control inventory. Keep one row per specific asset and threat pairing and merge rows that share a fix.
Why not use a 1 to 10 scale or a dollar figure?
A 1 to 5 scale is coarse enough that two people will usually agree, which is what makes the ranking usable. Dollar estimates are better for individual decisions, such as whether a second internet line is worth its cost, and belong in a separate calculation rather than in the ranking column.
Is a business continuity plan risk assessment different?
It is the same register viewed through one lens: the rows about outages, data loss and recovery time. Filter the register for Impact 4 and 5 entries involving availability, and you have the risk section of a continuity plan.
Turn findings into a register
If you would rather have an engineer build the first version with you, our IT audit ends with the findings and evidence this register needs. Book a call and we will scope it to your business.
Sources and further reading
- NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments (September 2012): the likelihood and impact structure this template simplifies. Checked on November 7, 2026.
- NIST Cybersecurity Framework 2.0: risk assessment under the Identify function. Checked on November 7, 2026.
Discuss it audit services for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.