Risk Assessment Workbook

Guides an assessor through a structured assessment of a system, process or supplier and outputs register-ready entries.

Available soon

Format: Excel
Size: 93 KB
Length: 14 sheets
Version: 1.1
Updated: 28 Sep 2026

What's inside

Instructions
Scope & Context
Threat Checklist
Existing Controls
Scenario Assessment
Results
Register-Ready Output
Scales & Appetite
Lists
Definitions
Framework References

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Scope & Context: answer each item in the Answer column for the one system, process or supplier you are assessing. Name the business service it supports and its executive: that person is usually the risk owner (RM-02). Record the reason for the assessment — scheduled (RM-09), new, or one of the triggers that force a reassessment within [[10]] working days (RM-10).
2	Threat Checklist: for each threat type, decide whether it could harm this subject. The list is the Cyber Risk Scenario Library's threat list, and column E names the library scenarios to consider for each. Answer: scenario raised (name its A-nn), covered by an existing register entry (name its R-nn), not relevant or not material (give the reason), or not yet assessed.
3	Existing Controls: list the controls in place today that affect these threats, with the evidence you saw and how effective they are. Count a control only if you have seen evidence that it works; 'Not tested' controls should not lower a residual score.
4	Scenario Assessment: one row per risk scenario raised. Write it in the four RM-01 parts — threat, weakness, asset or service, consequence — starting from the library entry where one fits (put its SC-nn in Library ID). Choose the category.
5	Score the inherent impact on each of the 5 areas (Financial, Service, Data, Legal and regulatory, Reputation) from 1 to 4 using the anchors on the Scales & Appetite sheet. The inherent impact is the worst of them — no area is weighted (RM-03). Where personal data is involved, score the Data area on the worse of the harm to the organisation and the harm to the people whose data it is (GDPR Article 32). Then score the inherent likelihood: the chance over the next 12 months without your controls.
6	Name the existing controls the scenario relies on (EC-nn), then score the residual impact and likelihood with those controls as they work today. The residual can never be higher than the inherent.
7	Read the calculated band (RM-04), position against the category's appetite (RM-05), who may accept (RM-08) and the suggested treatment. Choose the treatment and name the risk owner. A risk outside appetite needs a treatment decision within 30 calendar days (RM-06); actions go to the Risk Treatment Plan and acceptances to the Risk Acceptance Form & Approval Record.
8	Clear every Check (calc) that does not say OK — on the Threat Checklist, Existing Controls and Scenario Assessment. The Results sheet counts what is left and ranks the scenarios by residual score.
9	Register-Ready Output: the rows marked OK appear here in the Information Security Risk Register's columns. Copy the filled rows, and in the register use Paste Special → Values with 'Skip blanks' ('Skip empty cells' in LibreOffice) on its first empty row: the grey columns are left empty so the register's own formulas are kept. Give new risks their R-nn in the register.
10	Set the appetite level of each category on the Scales & Appetite sheet to match your approved Cyber Risk Appetite Statement Template. The EXAMPLE levels are the example organisation's.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

The EXAMPLE. The workbook opens filled in with the example organisation's reassessment of its online ordering service (a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders), dated 2026-09-30, the example quarter end. It produces three register entries — R-01, R-03, R-05 — with the same scores as the example Information Security Risk Register. Rows marked EXAMPLE in column A, and the Scope & Context answers, are the example.

To start your own assessment: save a copy, delete the EXAMPLE rows on the Threat Checklist answers (clear columns F to H), Existing Controls and Scenario Assessment, and clear the Answer column on Scope & Context. Replace the assessment date with the date of your assessment (or =TODAY() while drafting). Nothing else needs changing.

Weights. The standard questionnaire has weighted questions; a risk assessment does not. Impact is the worst of the five areas (RM-03), not an average, because one Severe consequence is Severe however mild the others are. Score = impact × likelihood; the band follows (Low 1–3, Medium 4–6, High 8–9, Critical 12–16).

Tailoring — small organisation: assess your two or three most important services first, one workbook each; keep scenarios few and well owned. Where you have no evidence that a control works, score as if it did not.

Tailoring — regulated entity: NIS2 Article 21(1) expects risk-based measures; DORA Article 8(3) expects a risk assessment on each major change to systems, processes or procedures — use this workbook for that and keep it with the change record. Record 'Major change' as the reason. Where personal data is involved, GDPR Article 32(2) asks that the risks of the processing be taken into account in choosing the level of security: score the Data area on the harm to the people as well as to the organisation.

Tailoring — IT run by a service provider: assess with the provider in the room; ask them for the evidence behind each control (reports, test results), and record the provider's controls as yours only if the contract requires them. The risk owner stays inside your organisation.

Limitations: see the foot of the Results sheet.

Scope & Context

What is being assessed, and its context. Answer in column E. The answers shown are the EXAMPLE; replace them with yours.

Example	No.	Item	What to record	Answer
EXAMPLE	1	Assessment reference	Your own reference, prefix AS- (for example AS-2026-03), so register entries can point back to this assessment. RA- is used by risk acceptances.	AS-2026-03
EXAMPLE	2	Subject type	What is being assessed.	System or service
EXAMPLE	3	Subject name	The system, process or supplier, as the business knows it.	Online ordering service
EXAMPLE	4	Description	What it does and for whom, in a sentence or two.	The customer website and ordering platform. The example organisation is a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders.
EXAMPLE	5	Business service it supports	The service that would suffer if this went wrong. Its executive is usually the risk owner (RM-02).	Taking and fulfilling customer orders
EXAMPLE	6	Service owner	The executive accountable for that service.	Chief Operating Officer
EXAMPLE	7	Information it holds or processes	Types of data, whether personal data is involved, and roughly how much.	Business customers' contact names, delivery addresses, order history and account credentials. Personal data: yes. Card details are entered on the payment provider's page, not stored here.
EXAMPLE	8	Users	Who uses it: customers, staff, suppliers, administrators.	Customers ordering online; customer service staff; administrators at the managed IT provider.
EXAMPLE	9	Dependencies	Suppliers, hosting and other systems it needs to work.	Managed IT provider (administration and backups); hosting provider; payment service provider; warehouse management system for dispatch.
EXAMPLE	10	Reachable from the internet?	Yes or No, and what is exposed.	Yes: the ordering website and customer login.
EXAMPLE	11	Legal and regulatory scope	Laws, regulations and contracts that apply (for example GDPR, NIS2, DORA, card payment rules).	GDPR (customer personal data); NIS2 (the organisation is in scope); customer contracts with service levels.
EXAMPLE	12	Reason for this assessment	Scheduled, new, or a trigger (RM-10).	Scheduled reassessment (RM-09)
EXAMPLE	13	In scope	What this assessment covers.	The ordering website, its application and database, customer accounts, and their recovery.
EXAMPLE	14	Out of scope	What it does not cover, and where that is assessed instead.	Warehouse systems (R-04); staff email and supplier payments (organisation-wide entries R-02 and R-09).
EXAMPLE	15	Assessor	Who ran the assessment.	[[e.g. Information Security Manager]]
EXAMPLE	16	People consulted	Who gave evidence: owners, IT, suppliers.	Chief Operating Officer; Head of IT; the managed IT provider's service manager.
EXAMPLE	17	Assessment date	The date of the assessment. The EXAMPLE uses the example quarter end; replace it with your own date.	30 Sep 2026

Threat Checklist

The Cyber Risk Scenario Library's threat list. For each threat, decide whether it could harm this subject, and record what you raised or why not. Columns F to H are yours.

Example	Threat ID	Threat type	What it looks like	Library scenarios to consider	Could it harm this subject?	Raised as (A-nn) or covered by (R-nn)	Why, and the evidence	Check (calc)
EXAMPLE	TH-01	Ransomware and extortion	Criminals get in, steal data and encrypt systems, then demand payment to restore them or not to publish what they took.	SC-01, SC-02, SC-05	Yes — scenario raised	A-01	The ordering platform faces the internet and ransomware groups target distributors; recovery is slow.	OK
EXAMPLE	TH-02	Exploitation of unpatched or exposed systems	Attackers use a known weakness in an internet-facing system (remote access gateway, web server, remote desktop) before it is fixed.	SC-03, SC-06, SC-11	Yes — scenario raised	A-02, A-03	Internet-facing application and customer database; patching has slipped this quarter.	OK
EXAMPLE	TH-03	Phishing and account takeover	A member of staff is tricked into giving away a password or approving a sign-in, and the attacker uses their account.	SC-22, SC-24, SC-39, SC-41, SC-47	Yes — covered by an existing register entry	R-09	Customer service and administrator accounts are staff accounts, covered organisation-wide.	OK
EXAMPLE	TH-04	Payment and invoice fraud	A fraudster impersonates a supplier, an executive or an employee to have money paid to the wrong bank account (business email compromise).	SC-20, SC-21, SC-23	No — not relevant or not material		The ordering service makes no supplier payments; supplier payment fraud is R-02.	OK
EXAMPLE	TH-05	Password attacks on customer or staff accounts	Attackers try passwords leaked from other websites, or guess common ones, against login pages (credential stuffing).	SC-14	Yes — scenario raised	A-02	Customer logins are part of A-02's weakness: stolen customer passwords are one route to customer data.	OK
EXAMPLE	TH-06	Denial of service	A flood of traffic makes a website or online service unusable, sometimes with a demand for payment to stop.	SC-07	No — not relevant or not material		The website sits behind the hosting provider's denial-of-service protection; an outage of a few hours is within what the service owner accepts.	OK
EXAMPLE	TH-07	Malicious insider	Someone with legitimate access — an employee, contractor or administrator — misuses it to steal, change or destroy information or money.	SC-25, SC-40, SC-42, SC-43	Yes — covered by an existing register entry	R-07	Administrator misuse is assessed organisation-wide.	OK
EXAMPLE	TH-08	Human error	A mistake by someone with legitimate access: data sent to the wrong person, files deleted, a change that breaks a system.	SC-08, SC-15, SC-44, SC-46	No — not relevant or not material		Changes go through the managed IT provider's change process with a back-out plan; no failed change in the last 12 months.	OK
EXAMPLE	TH-09	Loss or theft of equipment	A laptop, phone or storage device holding the organisation's information is lost, stolen or not returned.	SC-13, SC-16	No — not relevant or not material		No ordering data is held on laptops; the warehouse laptops are R-12.	OK
EXAMPLE	TH-10	Supplier failure or compromise	A supplier the organisation depends on is attacked, has an outage, or stops trading, and its problem becomes the organisation's.	SC-33, SC-34, SC-37	Yes — covered by an existing register entry	R-06	The managed IT provider administers the platform and its backups.	OK
EXAMPLE	TH-11	Misconfiguration	A system or cloud service is set up so that information or access is open to people who should not have it.	SC-10, SC-12, SC-17, SC-19	Yes — covered by an existing register entry	R-11	Cloud storage used by the ordering service is in the monthly configuration scan.	OK
EXAMPLE	TH-12	Technical or environmental failure	Hardware, power, cooling, a hosting region or a failed recovery stops a service, with no attacker involved.	SC-04, SC-09, SC-35, SC-38	Yes — covered by an existing register entry	R-10	Restore of critical systems is assessed organisation-wide; the ordering platform's own recovery time is part of A-01.	OK
EXAMPLE	TH-13	Software and web supply-chain attack	Malicious code arrives through a trusted route: a vendor's software update, a code library, or a script on the organisation's own website.	SC-18, SC-36	No — not relevant or not material		Card details are entered only on the payment provider's page; no third-party scripts run on it.	OK
EXAMPLE	TH-14	Loss of key people or knowledge	The only people who can run, fix or recover a system leave or are unavailable when needed.	SC-45	Yes — scenario raised	A-03	The ordering platform team lost two engineers this quarter and on-time patching fell to 81% (target 95% within 14 calendar days).	OK
EXAMPLE	TH-15	Failure to meet a legal or regulatory obligation	A deadline, notification or requirement under law, regulation or contract is missed, whatever the underlying event.	SC-26, SC-27, SC-28, SC-29, SC-30, SC-31, SC-32	Yes — covered by an existing register entry	R-08	Incident reporting is assessed organisation-wide.	OK

Existing Controls

The controls in place today that affect this subject's threats. Count a control only on evidence that it works. Scenario rows refer to these by EC-nn.

Example	Control ID	Control	Type	Threats it addresses (TH-nn)	Effectiveness	Evidence seen	Control owner	Check (calc)
EXAMPLE	EC-01	Nightly backups of the ordering platform	Respond or recover	TH-01, TH-12	Partly effective	Backup reports checked; a full restore of the platform has not been proven within 2 days	Head of IT	OK
EXAMPLE	EC-02	Endpoint detection on servers	Detect	TH-01, TH-02	Effective	Provider's monthly service report; alerts tested	Head of IT	OK
EXAMPLE	EC-03	Web application firewall in front of the ordering service and other internet-facing systems	Prevent	TH-02, TH-05	Effective	Configuration reviewed; blocking mode confirmed	Head of IT	OK
EXAMPLE	EC-04	Yearly penetration test of the ordering service	Detect	TH-02, TH-05	Effective	Last report read; its findings are closed	Head of IT	OK
EXAMPLE	EC-05	Customer data encrypted at rest	Prevent	TH-02	Effective	Database encryption setting seen	Head of IT	OK
EXAMPLE	EC-06	Monthly vulnerability scanning	Detect	TH-02	Effective	Scan reports for the last three months	Head of IT	OK
EXAMPLE	EC-07	Patching deadlines by severity	Prevent	TH-02, TH-14	Partly effective	Critical weaknesses fixed on time this quarter: 81%, against 95% within 14 calendar days	Head of IT	OK

Scenario Assessment

One row per risk scenario. Yellow columns are yours; the rest calculate. Impact is the worst of the five areas (RM-03); position, who may accept and the suggested treatment follow from the residual band and the category's appetite.

Example	Scenario ID	Library ID (SC-nn)	Register ID (R-nn), if already registered	Category ID	Category (calc)	Risk title	Threat ID	Threat — who or what	Weakness it uses	Asset or service affected	Consequence	Impact: Financial (1–4)	Impact: Service (1–4)	Impact: Data (1–4)	Impact: Legal and regulatory (1–4)	Impact: Reputation (1–4)	Inherent impact (calc: worst area)	Worst impact area (calc)	Inherent likelihood (1–4)	Inherent score (calc)	Inherent band (calc)	Existing controls relied on	Control IDs (EC-nn)	Residual impact (1–4)	Residual likelihood (1–4)	Residual score (calc)	Residual band (calc)	Category appetite level (calc)	Position against appetite (calc)	Who may accept (calc)	Suggested treatment (calc)	Treatment chosen	Risk owner	Scoring notes	Check (calc)	Output order (calc)	Ranking key (calc)
EXAMPLE	A-01	SC-01	R-01	RC-01	Service availability	Ransomware takes online ordering offline for more than 2 days	TH-01	Criminal ransomware group	The ordering platform cannot be restored from backup in less than 4 days	The online ordering service (60% of orders)	Loss of about €1.2m of orders per week; customer contracts breached	4	4	2	3	3	4	Financial, Service	3	12	Critical	Nightly backups of the ordering platform; endpoint detection on servers; recovery of the whole platform not yet proven within 2 days	EC-01, EC-02	4	2	8	High	Cautious	Outside appetite, within tolerance	Accountable executive and Head of Information Security, and executive management as well	Reduce, avoid or transfer; decide within 30 calendar days (RM-06). Accepting needs executive management as well as the band's approvers.	Reduce	Chief Operating Officer	Impact Severe on Service and Financial: loss of about €1.2m of orders per week; customer contracts breached. Residual likelihood falls to Possible with endpoint detection, but impact stays Severe until the platform can be restored within 2 days (TA-01).	OK	1	812.0996
EXAMPLE	A-02	SC-11	R-03	RC-02	Customer and personal data	Customer data exposed through the ordering service	TH-02	Attackers targeting the customer database	A weakness in the ordering service's web application or its customer accounts	Customer records in the online ordering service	Customer personal data exposed at scale. Regulatory fine, notification cost and lost trade; about €0.8m	3	1	4	4	3	4	Data, Legal and regulatory	2	8	High	Web application firewall; yearly penetration test of the ordering service; customer data encrypted at rest	EC-03, EC-04, EC-05	4	1	4	Medium	Cautious	Within appetite	Risk owner and Head of Information Security	Within appetite: accept at the band's level on the Risk Acceptance Form, or reduce further if a cheap control closes the gap.	Reduce	Chief Operating Officer	Impact Severe on Data and Legal: personal data at scale, a notifiable breach (regulatory fine, notification cost and lost trade; about €0.8m). Tested application and encrypted data make it Unlikely.	OK	2	408.0995
EXAMPLE	A-03	SC-03	R-05	RC-01	Service availability	Critical weaknesses on internet-facing systems exploited before they are fixed	TH-02	Attackers scanning the internet for known weaknesses	Critical security updates on internet-facing systems are applied later than the agreed deadline	Internet-facing systems (websites, ordering or customer portals, remote access)	Attacker gains a foothold for ransomware or data theft; service disrupted while systems are rebuilt	2	3	3	2	2	3	Service, Data	3	9	High	Monthly vulnerability scanning; patching deadlines by severity; internet-facing systems behind a web application firewall	EC-03, EC-06, EC-07	3	2	6	Medium	Cautious	Within appetite	Risk owner and Head of Information Security	Within appetite: accept at the band's level on the Risk Acceptance Form, or reduce further if a cheap control closes the gap.	Reduce	Head of IT	Impact Major on Service and Data. Scanning and the firewall make exploitation Possible rather than Likely; patching is behind after two engineers left (TA-03).	OK	3	609.0994

Results

Results

Calculated from the other sheets. The prioritised list ranks the scenarios by residual score (then inherent score). Nothing here is typed.

This assessment

Subject		Online ordering service (AS-2026-03)
Assessment date		30 Sep 2026	EXAMPLE: these results are the worked example. Delete the EXAMPLE rows to see your own.

Counts

Measure	Result	What it means
Scenarios assessed	3	Rows on Scenario Assessment with a scenario ID.
Ready for the register	3	Scenario rows whose check says OK; they appear on Register-Ready Output.
Scenario rows to resolve	0	Fix these before sign-off.
Threat checklist items to resolve	0	Including threats not yet assessed.
Control rows to resolve	0	Controls without an ID, effectiveness or evidence.
Residual Low (1–3)	0	Who may accept: Risk owner.
Residual Medium (4–6)	2	Who may accept: Risk owner and Head of Information Security.
Residual High (8–9)	1	Who may accept: Accountable executive and Head of Information Security.
Residual Critical (12–16)	0	Who may accept: The board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management.
Within appetite	2	No decision needed beyond the chosen treatment.
Outside appetite, within tolerance	1	A treatment decision within 30 calendar days (RM-06); accepting needs executive management as well as the band's approvers.
Outside tolerance	0	Escalate at once; only the board or its equivalent may accept (RM-08).

Scenarios in priority order (highest residual score first)

#	Scenario	Risk title	Residual	Position	Suggested treatment	Treatment chosen	Risk owner
1	A-01	Ransomware takes online ordering offline for more than 2 days	8 High	Outside appetite, within tolerance	Reduce, avoid or transfer; decide within 30 calendar days (RM-06). Accepting needs executive management as well as the band's approvers.	Reduce	Chief Operating Officer
2	A-03	Critical weaknesses on internet-facing systems exploited before they are fixed	6 Medium	Within appetite	Within appetite: accept at the band's level on the Risk Acceptance Form, or reduce further if a cheap control closes the gap.	Reduce	Head of IT
3	A-02	Customer data exposed through the ordering service	4 Medium	Within appetite	Within appetite: accept at the band's level on the Risk Acceptance Form, or reduce further if a cheap control closes the gap.	Reduce	Chief Operating Officer

Ranking: residual score, then inherent score, then the order on the Scenario Assessment sheet. Up to 8 scenarios are listed. A risk outside appetite is always treated first, whatever its rank (RM-06).

Limitations

The scores are judgements. They are only as good as the evidence behind them and the people in the room; record the evidence in the scoring notes so the next assessor can challenge it.

The workbook assesses one subject. Risks that cut across many subjects (phishing, supplier failure, backups) belong in the register once, owned organisation-wide; this workbook points to them rather than re-scoring them.

Likelihood is over the next 12 months, as the scale defines it. A rare but catastrophic scenario can score Low and still deserve a tested plan: read the impact as well as the band.

The Register-Ready Output is a proposal until the risk owner agrees it. The Information Security Risk Register is the single record (RM-11); this workbook is the working behind it.

Register-Ready Output

In the Information Security Risk Register's columns. Copy the filled rows; in the register, Paste Special → Values with 'Skip blanks' on its first empty row. Grey columns are the register's to calculate or record and are left empty. Do not type here.

Example	Risk ID	Category	Risk scenario	Risk owner	Inherent impact (1–4)	Inherent likelihood (1–4)	Existing controls	Residual impact (1–4)	Residual likelihood (1–4)	Treatment	Notes
EXAMPLE	R-01	Service availability	Ransomware takes online ordering offline for more than 2 days	Chief Operating Officer	4	3	Nightly backups of the ordering platform; endpoint detection on servers; recovery of the whole platform not yet proven within 2 days	4	2	Reduce	From risk assessment AS-2026-03 of Online ordering service, 2026-09-30, scenario A-01 (library SC-01)
EXAMPLE	R-03	Customer and personal data	Customer data exposed through the ordering service	Chief Operating Officer	4	2	Web application firewall; yearly penetration test of the ordering service; customer data encrypted at rest	4	1	Reduce	From risk assessment AS-2026-03 of Online ordering service, 2026-09-30, scenario A-02 (library SC-11)
EXAMPLE	R-05	Service availability	Critical weaknesses on internet-facing systems exploited before they are fixed	Head of IT	3	3	Monthly vulnerability scanning; patching deadlines by severity; internet-facing systems behind a web application firewall	3	2	Reduce	From risk assessment AS-2026-03 of Online ordering service, 2026-09-30, scenario A-03 (library SC-03)

Scales & Appetite

Scales and appetite

The Risk Assessment Methodology & Scoring Model's anchors, to score against, and each category's appetite level. Set the appetite levels (yellow) from your approved Cyber Risk Appetite Statement Template.

Impact — score each area, then take the worst (RM-03)

Area	1 Minor	2 Moderate	3 Major	4 Severe
Financial	less than [[€50,000]]	[[€50,000]] to [[€250,000]]	[[€250,000]] to [[€1,000,000]]	more than [[€1,000,000]]
Service	an internal service degraded for hours	a customer service degraded, or an internal service stopped, for up to [[1]] day	a core customer service stopped for up to [[2]] days	a core customer service stopped for more than [[2]] days
Data	internal, non-personal data	internal confidential data, or personal data of a few people	personal or customer data of [[hundreds]] of people, or commercially sensitive data	personal or customer data at scale
Legal and regulatory	no notification or breach	a minor breach of contract or policy, put right without penalty	a formal enquiry by a regulator or customer, or a contract breach with penalties	a notifiable breach, enforcement or contract termination
Reputation	not noticed outside the team	noticed by some customers or suppliers	complaints from several major customers, or regional or trade press	national press, or loss of a major customer
Where personal data is involved, score the Data area on the worse of the harm to the organisation and the harm to the people whose data it is (GDPR Article 32). General meaning of each level: 1 Minor — affects one system of Standard criticality or non-sensitive data; no customer or regulatory effect. 2 Moderate — affects a High criticality system or internal confidential data; limited, recoverable disruption. 3 Major — affects a Critical system, personal or customer data, or a regulated service; notifiable if it went wrong. 4 Severe — could stop a core business service, expose sensitive data at scale, or breach a legal obligation.

Likelihood — the chance over the next 12 months (RM-03)

Level	Chance	Signs
1 Unlikely	less than [[20]]% in the next 12 months	Not seen at organisations like ours in recent years, or only with rare skill or access.
2 Possible	[[20]]% to [[50]]% in the next 12 months	Happens regularly to organisations like ours; our controls make it harder but not rare.
3 Likely	[[50]]% to [[90]]% in the next 12 months	Happening now to organisations like ours, or has happened to us, and the gap is still open.
4 Almost certain	more than [[90]]% in the next 12 months, or already happening	Being attempted against us now, with little in the way.

Bands and who may accept (RM-04, RM-08)

Band	Scores	Who may accept	Acceptance reviewed within
Low	1–3	Risk owner	12 months
Medium	4–6	Risk owner and Head of Information Security	12 months
High	8–9	Accountable executive and Head of Information Security	6 months
Critical	12–16	The board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management	3 months

Outside appetite: the band's approvers, and executive management as well (Critical is already the board's). Outside tolerance: the band's approvers recommend; only the board or its equivalent may accept.

Appetite levels

Level	Appetite (highest band accepted)	Tolerance (highest band tolerated while a plan brings it back)	Meaning
Averse	Low	Medium	We avoid this risk and act on anything above Low.
Cautious	Medium	High	We accept some risk for a clear business benefit, with controls.
Open	High	High	We accept higher risk to pursue opportunity; Critical is never within tolerance.

Category appetite — set yours (EXAMPLE levels shown)

Category ID	Category	Appetite level	Appetite (calc)	Tolerance (calc)
RC-01	Service availability	Cautious	Medium	High
RC-02	Customer and personal data	Cautious	Medium	High
RC-03	Financial fraud	Cautious	Medium	High
RC-04	Regulatory compliance	Averse	Low	Medium
RC-05	Third-party dependency	Cautious	Medium	High
RC-06	People and insider	Cautious	Medium	High

EXAMPLE: the levels shown are the example organisation's. Replace them with the levels in your approved Cyber Risk Appetite Statement Template.

Lists

CategoryID	ThreatID	ImpactArea	BandName	BandMin	AcceptApprover	AppetiteLevel	LevelAppetite	LevelTolerance	Treatment	ChecklistAnswer	ControlType	Effectiveness	SubjectType	Reason
RC-01	TH-01	Financial	Low	1	Risk owner	Averse	Low	Medium	Reduce	Yes — scenario raised	Prevent	Effective	System or service	Scheduled reassessment (RM-09)
RC-02	TH-02	Service	Medium	4	Risk owner and Head of Information Security	Cautious	Medium	High	Avoid	Yes — covered by an existing register entry	Detect	Partly effective	Process	New system, process or supplier
RC-03	TH-03	Data	High	8	Accountable executive and Head of Information Security	Open	High	High	Transfer	No — not relevant or not material	Respond or recover	Not effective	Supplier	A major incident, or a near miss that shows a risk was underrated
RC-04	TH-04	Legal and regulatory	Critical	12	The board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management				Accept	Not yet assessed		Not tested	Project or change	A major change to systems, processes, suppliers or the organisation
RC-05	TH-05	Reputation												A new or changed threat relevant to our services (threat intelligence)
RC-06	TH-06													An audit, test or assessment finding
	TH-07													A change in law, regulation or a key contract

TH-08

TH-09

TH-10

TH-11

TH-12

TH-13

TH-14

TH-15

Definitions

Definitions

Term	Meaning in this workbook
Risk assessment	Identifying the risks to one system, process or supplier, scoring them and deciding what to do (ISO/IEC 27001 Clause 8.2 asks for it at planned intervals and on significant change).
Subject	The system, process or supplier this workbook assesses. One workbook, one subject.
Risk scenario	A threat, the weakness it uses, the asset or service affected, and the consequence (RM-01).
Threat type	A group of threats from the Cyber Risk Scenario Library's threat list (TH-nn).
Existing control	A measure in place today that makes a scenario less likely or less harmful. Counted only on evidence.
Effectiveness	Effective: evidence shows it works as intended. Partly effective: it works but with a known gap. Not effective: it does not do what it should. Not tested: no evidence either way — do not rely on it.
Impact area	The kinds of consequence impact is judged on: Financial, Service, Data, Legal and regulatory, Reputation.
Inherent	Before the existing controls are counted.
Residual	With the existing controls as they work today.
Score	Impact × likelihood, 1 to 16.
Band — Low	Score 1–3. Who may accept: Risk owner.
Band — Medium	Score 4–6. Who may accept: Risk owner and Head of Information Security.
Band — High	Score 8–9. Who may accept: Accountable executive and Head of Information Security.
Band — Critical	Score 12–16. Who may accept: The board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management.
Appetite	The highest residual band a category accepts without escalation.
Tolerance	The highest residual band a category tolerates while a plan brings it back within appetite. Critical is never within tolerance.
Appetite level — Averse	We avoid this risk and act on anything above Low. Appetite Low; tolerance Medium.
Appetite level — Cautious	We accept some risk for a clear business benefit, with controls. Appetite Medium; tolerance High.
Appetite level — Open	We accept higher risk to pursue opportunity; Critical is never within tolerance. Appetite High; tolerance High.
Position against appetite	Within appetite, Outside appetite, within tolerance, Outside tolerance — the residual band compared with the category's appetite and tolerance (RM-05).
Treatment — Reduce	Change the likelihood or the impact with controls.
Treatment — Avoid	Stop the activity that creates the risk.
Treatment — Transfer	Share the impact with a third party, for example by insurance or contract; the risk owner still owns the risk.
Treatment — Accept	Keep the residual risk knowingly, recorded and approved at the right level (Risk Acceptance Form).
Risk owner	The executive accountable for the service or asset the risk would hurt, not the security team (RM-02).
Register-ready	A scenario row whose check says OK: complete enough to enter in the Information Security Risk Register.
RM-nn	The rules in the Risk Assessment Methodology & Scoring Model.
AS-, A-nn, EC-nn, R-nn, SC-nn, TH-nn	Assessment reference (AS-, so it is not confused with a risk acceptance, RA-); scenario in this assessment; existing control in this assessment; entry in the Information Security Risk Register; entry in the Cyber Risk Scenario Library; threat type in its threat list.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
EXAMPLE row	A row of the worked example (the online ordering service). Delete before approval.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 8.2 — Information security risk assessment	The workbook as a whole: one assessment of one subject, run on schedule or on change
ISO/IEC 27001:2022	Clause 6.1.2 — Information security risk assessment	Scenario Assessment: RM-01 scenarios, impact and likelihood, bands and position; Scales & Appetite
NIST CSF 2.0	ID.RA-03 — “Internal and external threats to the organization are identified and recorded”	Threat Checklist
NIST CSF 2.0	ID.RA-05 — “Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization”	Scenario Assessment: inherent and residual scores; Results: scenarios in priority order
DORA — Regulation (EU) 2022/2554	Article 8(3) — perform a risk assessment upon each major change in systems, processes or procedures	Instructions: tailoring for a regulated entity — an assessment on each major change
GDPR — Regulation (EU) 2016/679	Article 32(2) — in assessing the appropriate level of security, account is taken of the risks presented by processing	Scenario Assessment: the Data impact area scored on the harm to the people as well as the organisation

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR)