A cybersecurity risk assessment is a written look at what could go wrong with the data you hold, how likely and how bad each problem would be, and what you'll do about it. For a small business, it's the step that tells you which security work matters and which can wait. You find where client information lives, list realistic threats to it, rate each one, check what already protects it, and decide whether to fix, reduce, transfer or accept each risk.
If you run a tax practice, mortgage brokerage, title company, lender or a dealership that finances cars, it isn't optional. The FTC Safeguards Rule says your whole security program has to be based on one, and most covered firms have to put it in writing. Only firms holding data on fewer than 5,000 consumers skip the written version, and they still have to do the assessment. A first pass takes a few hours, a spreadsheet and whoever knows how your IT is set up.
What a risk assessment actually is
Strip away the jargon and it's three questions.
- What client information do we have, and where does it live?
- What could happen to it, and how bad would that be?
- What are we doing about each risk, and what are we choosing to live with?
Security people call it an information security risk assessment. Insurers and auditors may call it a risk analysis. It's the same idea. You can't protect data you haven't found, and you can't decide what to fix first without knowing which risks are biggest.
It's also not a scan or a test. A vulnerability assessment or a penetration test checks your systems for technical holes. A risk assessment is wider. It covers people, paper, vendors and habits too, like the shared password on the front desk or the box of old returns in the storage unit.
What the FTC Safeguards Rule requires
The rule tells covered firms to "base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information" (16 CFR 314.4(b)).
It then says the assessment shall be written and include three things.
- Criteria for judging and ranking the risks you find
- Criteria for judging how well your systems and data are protected, including whether your current controls are good enough
- How each risk will be reduced or accepted, and how your security program will handle it
That's 314.4(b)(1). The rule also says you have to do it again "periodically" to recheck the risks and whether your safeguards still hold up, in 314.4(b)(2).
There's one exemption owners should know about. Firms that hold customer information on fewer than 5,000 consumers don't have to put the risk assessment in writing (16 CFR 314.6). They still have to do one and base their program on it. Only the written version is exempt.
Here's how the 5,000-consumer line changes what the rule asks, using the parts most related to risk and testing.
| Safeguards Rule requirement | 5,000 consumers or more | Fewer than 5,000 consumers |
|---|---|---|
| Base your security program on a risk assessment, 314.4(b) | Required | Required |
| Put the risk assessment in writing, 314.4(b)(1) | Required | Exempt |
| Redo the risk assessment periodically, 314.4(b)(2) | Required | Required |
| MFA for anyone accessing your systems, 314.4(c)(5) | Required | Required |
| Annual pen test and six-month vulnerability assessments unless you monitor continuously, 314.4(d)(2) | Required | Exempt |
| Written incident response plan, 314.4(h) | Required | Exempt |
Count carefully. Five thousand sounds like a lot until you add up every client file you've kept for seven years, plus prospects, plus co-borrowers and dependents. Many firms that feel small are over the line. Our FTC Safeguards Rule guide explains who's covered, and the GLBA compliance guide covers the law behind it.
Tax and accounting firms will see the risk assessment again in the IRS template for a written security plan. Our IRS WISP guide walks through that template.
Risk assessment for small business, step by step
You don't need special software to do a first pass. You need a few hours, a spreadsheet and whoever knows how your IT is set up.
1. Find the data
List every place client information lives. Tax or loan software, email, the file server, cloud storage, the client portal, laptops that go home, phones, the scanner's memory, paper files, off-site storage. Include the outside companies that touch it, like your payroll provider, document shredder or IT company.
2. List what could go wrong
For each place, ask what realistic things could happen. A phishing email takes over a mailbox. A laptop gets stolen from a car. A former employee still has a login. Ransomware locks the server during your busiest week. A vendor gets breached. Paper goes out with the regular trash.
Stick to things that could plausibly happen to a firm like yours. You're not writing a movie plot.
3. Rate each risk
Give each one a simple score for how likely it is and how much damage it would do. Low, medium and high is fine. The rule asks for criteria, so write down what each level means to you. For example, "high damage" might mean client Social Security numbers exposed or the office unable to work for a day or more.
4. Check what's already in place
Next to each risk, note what you already do about it. MFA on email. Encrypted laptops. A backup that's stored separately. Be honest here. "I think the IT guy set that up" is a finding, not a control.
5. Decide what to do
For every risk that's still medium or high, choose. Fix it, reduce it, move it to someone else (like an insurer, which only covers money and not the damage to trust), or accept it and write down why. Put a name and a date next to each fix.
6. Redo it on a schedule
Set a date to repeat it, and redo it whenever something big changes. A new office, new software, a merger, remote staff, a breach at a vendor. Once a year is a sensible floor for most small firms.
Common mistakes
Filling in a template and filing it. Plenty of firms have a security plan that was copied from a template once and never looked at again. A risk assessment that doesn't match how your office really works won't help you decide anything, and it won't hold up if a regulator or insurer asks how you reached your decisions.
Only looking at technology. Many breaches start with a person, a process or a vendor. Ask how a new hire gets access, how a departing one loses it, and how you confirm a change to wiring instructions.
Treating it as the IT company's job. Your IT provider can do most of the technical legwork, and should. But the rule puts the program on your firm. The owner, or the Qualified Individual you name, signs off on which risks you accept.
Never ranking anything. A list of 60 risks with no order is a to-do list nobody starts. Ranking is what turns it into a plan.
What you get out of it
A good risk assessment gives you a short, ordered list. Usually the top of that list for a small financial firm looks familiar. MFA everywhere, backups an attacker can't reach, staff who can spot a phishing email, someone watching for attacks, and a plan for the day something gets through.
It also gives you something to show. If an insurer, auditor or regulator asks why you made the choices you made, a dated assessment answers that.
Where to start
Block two hours this week, open a spreadsheet, and do step one. Just finding all your client data is usually eye-opening. If you'd rather start from a score, our security check gives you a plain one and can match you with one IT company that works with firms like yours.