Cybersecurity Risk Assessment: A Practical Guide for Australian Businesses

A cybersecurity risk assessment answers one blunt question: if something went wrong tomorrow, what would hurt the business most, and what are you doing about it? It turns a vague sense of unease into a short, ranked list of risks, each with an owner, a fix and a due date.

You don’t need a security department to run one. However, you do need an honest look at your systems, your people and your suppliers, plus a consistent way to score what you find. This guide sets out the six steps we use with Australian businesses, and the rules that now shape what “reasonable” security means here.

What a cybersecurity risk assessment actually measures

Every risk has three parts: something you value (an asset), something that could harm it (a threat) and a gap that lets the harm happen (a vulnerability). Take away any one of them and the risk shrinks. For example, a phishing email only becomes a serious risk if staff can be tricked and a stolen password is enough to get in.

The assessment then weighs two things for each risk: how likely it is, and how much damage it would do. As a result, you can compare very different problems on the same scale. Most risks fall into six broad groups.

Why a cybersecurity risk assessment is worth the effort

The numbers make part of the case. According to the Australian Signals Directorate (ASD), cybercrime keeps getting more expensive for smaller businesses.

The bigger payoff, though, is focus. Without an assessment, security spending tends to follow the latest scare or the loudest vendor. With one, you can show why MFA comes before a new firewall, or why testing backups matters more than another tool. In addition, a documented assessment gives insurers, clients and your board evidence that you take reasonable steps, which matters more now that privacy law spells those steps out.

How to run a cybersecurity risk assessment in six steps

The steps below work for a ten-person office or a multi-site business; larger organisations simply go deeper at each stage. Here’s the short version, followed by the detail.

Step 1: List and rank what you need to protect

Start with an inventory of anything that stores, processes or moves important data. Typical entries include Microsoft 365, your finance and payroll software, your CRM or job system, file shares, laptops and phones, your website and your key supplier accounts. Don’t forget the people with admin access.

Then rank each one. Ask what would happen if it disappeared for a day, if its data leaked, or if someone quietly changed it. Label each asset as critical, important or minor. To keep the list current, link it to staff onboarding and offboarding and to new software purchases.

Step 2: Name the threats to each asset

For each critical asset, ask who or what could compromise it, and how. Think beyond hackers. A disgruntled former employee, a supplier with too much access, a staff member who pays a fake invoice and a burst pipe in the server cupboard all belong on the list.

Step 3: Find the weak spots with evidence

A vulnerability is any gap a threat could use. Common examples include missing multi-factor authentication (MFA), shared or reused passwords, unpatched software, staff with admin rights they don’t need, a flat network where every device can reach every other, and backups that have never been restored.

Gather evidence rather than relying on memory. Useful sources include Microsoft Secure Score and your sign-in settings, a vulnerability scan, a phishing simulation, a test restore from backup and a short chat with each team about how they really work. In fact, those conversations often find the biggest gaps, such as a shared login that everyone “just uses”.

Step 4: Score likelihood and impact

Rate each risk on two scales. Likelihood asks how probable it is in the next 12 months, given the controls you have today. Impact asks how bad it would be in money, downtime, legal exposure and reputation. For most businesses, a simple low, medium and high scale is enough. Then combine the two to get a rating.

Write down why you gave each score, for example “no MFA on email, and phishing attempts arrive weekly”. Those notes keep the scoring honest. They also show exactly what would need to change to lower the rating.

Step 5: Decide how to treat each risk

For every high or extreme risk, choose one of four responses. You can reduce it with a control, avoid it by stopping the risky activity, transfer part of it (for example, through cyber insurance or a contract) or accept it with a documented reason. Most risks get reduced.

When you choose controls, ASD’s guidance is the natural baseline for Australian businesses. ASD Essentials, published on 15 October 2026, succeeds the Essential Eight over about two years. If you already work to the Essential Eight, keep going and map your controls across over time. Meanwhile, these fixes usually cut the most risk for the least effort:

Step 6: Record, report and repeat

Capture the results in a risk register. It needn’t be fancy, because a shared spreadsheet works. For each risk, record the asset, a one-line description, the likelihood, impact and rating, the planned treatment, an owner and a due date. Then write a one-page summary for leaders that explains the top five risks in plain English and what fixing them will cost in time and money.

Above all, treat the register as a living document. Review progress at your regular management meetings, and reassess at least once a year. You should also revisit it after any big change, such as a new system, an office move, a merger, a new key supplier or a security incident.

Australian rules that shape a cybersecurity risk assessment

Several laws now expect businesses to understand their risks and act on them. Here’s a quick overview; your lawyer can advise on how each one applies to you.

A risk assessment is one of the clearest ways to show you have taken reasonable steps. It also prepares you for a breach. If you already know where personal information lives and who can reach it, assessing an incident within the deadline becomes much easier.

How CAG can help

Our Perth team helps businesses run risk assessments and, more importantly, act on the results. We offer cyber security audits and Essential Eight assessments, and we can map your existing controls to ASD Essentials during the transition. After that, our cyber security services cover 24/7 monitoring, EDR with automatic containment, phishing simulations and security awareness training. Meanwhile, our disaster recovery work makes sure your backups restore when you need them.

To go further, read how managed IT strengthens your security strategy, the warning signs of a compromised business or our NIST compliance roadmap.