How Often Is "Often Enough" for a Risk Assessment?

Key Takeaways

Q: How often should our business do a risk assessment?

A: Most businesses should conduct at least one annual risk assessment per year. However, not all risk assessments are the same, and an annual assessment should not be the only time your business thinks about risk.

Many businesses struggle to do even one annual risk assessment, but the reality is that most businesses actually need more than that. A practical risk assessment program usually includes three types of reviews:

• Annual Cybersecurity Risk Assessment (CSRA)
• Quarterly Risk Reviews (QRRs)
• Event Driven Assessments (EDAs)

The Annual Cybersecurity Risk Assessment

The Annual Cybersecurity Risk Assessment is a comprehensive review of your business's cybersecurity posture, operational practices, compliance requirements, business continuity planning, and overall exposure to risk. This assessment should help identify major areas of improvement and provide a roadmap for reducing the company's risk.

Depending on the size and complexity of the business, these assessments may be performed internally, by an impartial/trusted third party or a combination of both. A third party can be especially valuable because it brings an outside perspective into the business environment to find gaps that internal teams may unintentionally overlook. While IT and security are its main focus, the CSRA covers a much broader scope than just a vulnerability scan, penetration test or IT audit. An assessment should include employee interviews, a review of security controls, an evaluation of policies and procedures, and a look at how well the company is prepared to prevent, detect, respond to, and recover from cybersecurity incidents.

Quarterly Risk Reviews

Quarterly Risk Reviews should be smaller review than the annual CSRA but should be taken just as seriously. These reviews help the business evaluate new threats, vulnerabilities, system changes, vendor changes, staffing changes, and other shifts in the business environment. For a growing company, quarterly reviews can help catch small problems before they become serious security issues. Annual reviews are still important, so don't skip them when doing QRRs, but this additionally gives a quarterly pulse check on the state of the company's security. If your company is growing quickly, QRRs will be your friend.

Event Driven Assessments

Event-driven assessments should happen whenever a major change occurs. These reviews are often overlooked or handled reactively, but they are critical when something changes the company's security environment. Ideally EDAs should become more of an "As Needed" review. If a company is doing annual and quarterly assessments, the event-driven assessment becomes important only when big changes happen in a company that can't wait. Examples include adding new line-of-business software, opening a new branch location, creating a new department, moving systems to the cloud, changing vendors, going through a merger or acquisition, or responding to a security incident.

Where most businesses get themselves in trouble is assuming that their IT staff or MSP is already doing this. The truth is that assessments don't magically happen. They require planning, collaboration across the entire company and follow-through with the findings. If you don't know if they are being done or not, that's an indication that they are not being done at all.

So how often should your business be doing these assessments?

• Annually – If your business is small and/or doesn't change in structure, staff or systems very often.
• Quarterly – If your business is growing quickly, regularly adding new technology, handling sensitive data, or operating in a regulated industry.
• Event Driven – Any time there is an incident or a big change in the company that could change the security ecosystem that has been established.

In summary, you should treat risk assessment as an ongoing business process, not a once-a-year checklist. The more your business changes, the more often you should re-assess.

If you don't know if they are being done or not, that's an indication that they are not being done at all.