Cybersecurity Risk Assessment: The Complete Guide
NIS2 mandates it. DORA builds an entire framework around it. StartComply automates your cybersecurity risk assessment lifecycle, from asset inventory and threat mapping to treatment tracking and audit-ready evidence.
Trusted by 100+ organisations across Europe
NIS2 Article 21 
DORA Article 6 
ISO 27001:2022 
Risk Assessment What you need to know about cybersecurity risk assessment
- A cybersecurity risk assessment is a mandatory, continuously evidenced process under NIS2 Article 21 and DORA Article 6, not a discretionary annual exercise.
- NIS2 fines for non-compliance can reach €10 million or 2% of global annual turnover for essential entities.
- Asset identification is the prerequisite for every subsequent step because you cannot assess risk to assets you have not catalogued.
- Qualitative and quantitative methodologies can both satisfy regulatory requirements when the chosen approach is documented and consistently applied.
- Supply chain and vendor risk assessment is explicitly required under NIS2 Article 21 and DORA Article 28.
- Continuous monitoring distinguishes a live risk management programme from a filed document.
- Spreadsheet-based risk registers are operationally fragile and cannot sustain the evidence trail regulators require.
Sources: NIS2 Directive, DORA Regulation. Last updated April 2026.
Risk Assessment Requires Evidence, Not Annual Spreadsheets
A continuous, evidenced cybersecurity risk assessment programme
- NIS2 Article 21: risk analysis and information system security policies as mandatory cybersecurity measures
- DORA Article 6: ICT risk management framework for financial entities
- DORA Article 8: identification and classification of ICT assets supporting critical functions
- DORA Article 28: third-party ICT risk assessments before and during supplier relationships
- ISO 27001:2022 Clause 6.1.2: defined and applied information security risk assessment process
Penalty exposure: NIS2 essential entities can face fines of up to €10M or 2% of global annual turnover. Sources: NIS2 Directive, DORA Regulation.
Point-in-time assessments, scattered evidence, unclear ownership
- Annual assessments that do not reflect current threat, asset, or supplier exposure
- Risk registers stored in spreadsheets with broken version control
- No clear link between risks, controls, regulatory articles, and evidence
- Accepted risks with no formal owner, approval, or documented rationale
- Missing review evidence after incidents, system changes, or new vendor relationships
- No operational path from assessment findings to treatment tracking
The audit reality: authorities do not only ask whether you assessed risk. They ask for scope, dates, owners, evidence, treatment decisions, and proof of review.
Everything You Need for Cybersecurity Risk Assessment
Asset Inventory and Scope Definition
StartComply gives you one authoritative record of every system, data asset, application, infrastructure component, and third-party dependency in assessment scope. Scope gaps stop hiding in legacy tools and shadow IT.
- Structured asset inventory for systems, data, infrastructure, cloud, and vendors
- Criticality and business impact fields for each asset
- Assessment boundaries documented with explicit exclusions
- Change-triggered reassessment when new assets or vendors are added
Threat and Vulnerability Mapping
Map credible threat scenarios to real assets instead of relying on a generic risk template. StartComply helps teams combine threat intelligence, vulnerability findings, and business context so likelihood scores are grounded in actual exposure.
- Threat scenarios covering ransomware, DDoS, insider risk, data exfiltration, and supply chain compromise
- Vulnerability data linked directly to affected assets
- Risk scoring calibrated by asset criticality and control effectiveness
- Continuous monitoring inputs between formal reviews
Prioritised Risk Register
Every assessment produces a structured register that links threats, assets, vulnerabilities, controls, owners, and treatment status. The result is not just a score. It is a prioritised risk register built for compliance evidence.
- Likelihood and impact scoring with consistent criteria
- Risk rating, owner, status, treatment plan, and due date per item
- Control mapping to NIS2, DORA, ISO 27001, and internal policies
- Decision history retained for every update
Risk Treatment and Corrective Action Tracking
Turn assessment findings into operational remediation. StartComply tracks whether each risk is mitigated, transferred, avoided, or accepted, with approvals and evidence attached to the treatment decision. No finding goes ownerless.
- Mitigate, transfer, avoid, and accept workflows
- Owner assignment and due dates for treatment actions
- Acceptance approvals with documented rationale
- Escalation when high-risk items remain open
Audit-Ready Evidence Packs
When an authority or certification auditor asks for evidence, StartComply exports the records that matter: methodology, scope, asset register, risk register, treatment decisions, review dates, and supporting documentation. Audit preparation becomes export work, not archaeology.
- Evidence linked to risks, controls, and regulatory requirements
- Full audit trail of reviews, edits, approvals, and treatment updates
- Exportable reports for NIS2, DORA, and ISO 27001 evidence requests
- Management-ready summaries for board reporting
Continuous Monitoring and Trigger-Based Reviews
Risk assessments cannot remain frozen for twelve months. StartComply supports scheduled reassessments and trigger-based reviews when incidents, system changes, new vendors, or vulnerability signals change your risk picture. Continuity becomes operational.
- Annual full review cadence plus targeted reassessments
- Trigger workflows for material changes and incidents
- Risk score updates between assessment cycles
- Documented review evidence for regulators and auditors
StartComply vs. The Alternatives
Not every cybersecurity risk assessment approach produces the evidence NIS2, DORA, and ISO 27001 auditors expect. The difference is operational proof, not just methodology.
StartComply was built for European organisations that need cybersecurity risk assessment workflows mapped to NIS2, DORA, and ISO 27001 without the overhead of a full enterprise GRC deployment.
What Is a Cybersecurity Risk Assessment?
A cybersecurity risk assessment is the systematic process of identifying, analysing, and evaluating risks to your organisation’s information assets. It answers three practical questions: what could go wrong, how likely it is, and what the impact would be. Then it drives treatment decisions.
The output is not a score or a RAG status. The output is a prioritised, evidenced risk register that links threats to assets, maps controls to regulatory requirements, and shows exactly how cybersecurity risk is managed. That distinction matters when an authority or certification auditor asks for proof.
Risk assessment is the analytical activity: identify, analyse, evaluate. Risk management is the ongoing programme that uses the assessment to decide how to treat risk, implement controls, and monitor effectiveness. Under NIS2 Article 21, you cannot credibly claim compliance without evidencing both.
Scope typically includes information assets, systems, applications, infrastructure, cloud environments, third-party dependencies, and people-related risks such as phishing and insider threat. Getting scope wrong is one of the most common assessment failures, especially when legacy systems, shadow IT, or vendor-managed environments are excluded.
You do not need separate risk registers. StartComply maps cybersecurity risk assessment activities to NIS2, DORA, and ISO 27001 in one workflow, so teams can maintain one living risk register and produce evidence for multiple frameworks.
The Cybersecurity Risk Assessment Process in Five Steps
Catalogue assets and scope Foundation
Build a complete inventory of information assets, systems, data flows, infrastructure, cloud environments, and third-party dependencies. A complete asset inventory is the prerequisite for every meaningful risk assessment.
Identify threats and vulnerabilities ENISA / NIST
For each asset, map credible threat scenarios such as ransomware, supply chain compromise, insider threat, DDoS, and data exfiltration. Combine threat intelligence with vulnerability data so likelihood scores are not guesses.
Score likelihood and impact Risk matrix
Assess likelihood and impact using consistent criteria. Impact should cover operational disruption, financial loss, regulatory exposure, and reputational damage. Consistent scoring criteria keep risk decisions defensible.
Select controls and assign owners NIS2 Art. 21
Decide whether each risk should be mitigated, transferred, avoided, or accepted. Link treatment actions to controls, regulatory articles, responsible owners, due dates, and evidence requirements.
Review continuously DORA Art. 6
Run scheduled full reviews and trigger-based reassessments after incidents, major changes, new vendor relationships, or material vulnerability signals. Continuous monitoring separates a live programme from a filed document.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Cybersecurity Risk Assessment
How often should a cybersecurity risk assessment be conducted?
European regulations do not specify one fixed frequency, but they do require continuous risk management rather than point-in-time exercises. Under NIS2 Article 21, risk assessments should be reviewed after significant changes or incidents, while ISO 27001:2022 requires periodic review. In practice, most organisations run a full reassessment annually and targeted reviews whenever there is a material change, new third-party relationship, or security incident. Continuous monitoring sits alongside formal reviews as an ongoing activity.
What is the difference between a cybersecurity risk assessment and a vulnerability assessment?
A vulnerability assessment identifies technical weaknesses such as unpatched software, misconfigured services, or exposed interfaces. A cybersecurity risk assessment is broader. It uses vulnerability data as one input, but also considers threat actors, business impact, asset criticality, and control effectiveness. A vulnerability assessment tells you what is broken. A risk assessment explains business impact and what should be done about it.
What does NIS2 require for cybersecurity risk assessments?
NIS2 Article 21 requires essential and important entities to implement risk analysis and information system security policies as part of their minimum cybersecurity measures. The assessment should take an all-hazards approach, cover supply chain risks, and remain proportionate to the entity’s exposure. Competent authorities can demand evidence of the risk assessment and treatment programme at any time.
Can a small organisation conduct a cybersecurity risk assessment without external consultants?
Yes. NIS2 and DORA both apply proportionality, meaning the depth and complexity of the assessment should match the organisation’s size and risk profile. A smaller organisation with a limited asset inventory and straightforward IT environment can run a credible assessment internally, provided the methodology is documented and the outputs are evidenced. Dedicated platforms reduce the resource burden by automating scoring, tracking, and evidence collection.
What is the difference between qualitative and quantitative risk assessment approaches?
Qualitative assessments score likelihood and impact on descriptive or numeric scales, such as low, medium, high, or 1 to 5. Quantitative assessments use financial models to calculate expected loss in monetary terms. Most European compliance teams use a hybrid approach: qualitative scoring for broad coverage and quantitative analysis for high-priority risks where treatment costs need financial justification.
How does DORA affect cybersecurity risk assessments for financial entities?
DORA requires financial entities to maintain an ICT risk management framework under Article 6. This includes ICT asset classification under Article 8, continuous ICT risk monitoring, and third-party ICT risk assessments under Article 28 for critical service providers. DORA goes further than a generic risk assessment because it requires formal ICT risk governance, resilience testing, and incident reporting. Financial entities need DORA-specific evidence, not just a general cyber risk register.
Make Your Cybersecurity Risk Assessment Audit-Ready.
Which Regulations Require Cybersecurity Risk Assessments?
Across Europe, cybersecurity risk assessment has become the starting point for compliance. NIS2, DORA, and ISO 27001:2022 all require organisations to define, run, review, and evidence risk assessment activity. The exact scope depends on your sector, entity classification, and ICT dependency profile.
The two most urgent regulatory drivers are:
Risk assessment is the evidence foundation. Controls, incident response, supplier oversight, resilience testing, and management reporting all depend on a current and defensible view of cyber risk.
Cybersecurity Risk Assessment Timeline: Where Things Stand Now
NIS2 transposition deadline. Member States were required to transpose the directive into national law, turning risk analysis and cybersecurity measures into national enforcement obligations.
DORA came into full application for financial entities, making ICT risk management, asset classification, and third-party ICT risk assessment obligations directly enforceable.
Competent authorities and certification auditors increasingly expect risk registers, treatment plans, review evidence, and documented methodology to be available on request.
Risk assessment obligations are operational. Organisations should be running scheduled reassessments and trigger-based reviews after incidents, major changes, and new vendor relationships.
Enforcement expectations are live. If your risk register is static, incomplete, or disconnected from treatment evidence, your organisation is carrying active compliance risk.
Audit-readiness check: Your risk assessment should show scope, methodology, asset inventory, threat scenarios, likelihood and impact criteria, treatment owners, approval history, and evidence of review after material changes.
The 10 Components of a Complete Cybersecurity Risk Assessment
A working cybersecurity risk assessment is more than a document. It contains ten components, each with a clear purpose, owner, cadence, and evidence trail that regulators and auditors can verify.
Documented methodology
A defined process for identifying, analysing, evaluating, treating, and reviewing cybersecurity risks. The methodology should be consistently applied and approved.
Scope and exclusions
The systems, data, applications, infrastructure, cloud services, third parties, and geographies in scope, plus any exclusions with documented rationale.
Complete asset inventory
A current inventory of information assets, systems, data flows, ICT services, infrastructure, and third-party dependencies linked to business criticality.
Threat scenario library
Credible threat scenarios such as ransomware, insider threat, DDoS, data exfiltration, supply chain compromise, and cloud misconfiguration mapped to assets.
Vulnerability and control inputs
Technical vulnerability findings, control effectiveness data, audit findings, and monitoring signals used to calibrate likelihood and exposure.
Likelihood and impact criteria
A consistent scoring model covering probability, operational disruption, financial loss, regulatory exposure, reputational damage, and data impact.
Prioritised risk register
A structured register with risk description, asset, threat, vulnerability, inherent risk, residual risk, owner, treatment decision, due date, and status.
Treatment plans and approvals
Mitigation, transfer, avoidance, or acceptance decisions with clear owners, control mapping, timelines, approvals, and supporting evidence.
Review triggers and cadence
Annual reassessments plus trigger-based reviews after incidents, major changes, new vendors, new systems, or significant vulnerability signals.
Audit evidence and reporting
Evidence packs showing methodology, scope, risk decisions, treatment progress, review dates, control mappings, and management reporting history.
