vaayaa Inclusive Education
Technical risk assessment

Cybersecurity and Information Security Operations Risk Assessment: Identity, Supplier, Logging and Recovery Risks

A worked example of how a security operations team finds, scores and controls risks to the confidentiality, integrity and availability of information, from identity compromise and supplier exposure to logging gaps and slow recovery.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Cybersecurity and Information Security Operations course

Executive summary

This assessment shows how a security operations team can find, rate and control the risks that threaten the confidentiality, integrity and availability of information. Eight risks were chosen because they are plausible in everyday security work, from identity compromise and supplier exposure to logging gaps and slow recovery. Identity compromise carries the highest inherent score because one stolen login can reach many systems. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once the additional controls are in place, while identity compromise stays at Medium because its impact remains serious. The first actions are phishing resistant multi-factor authentication for privileged access, a tested restore for critical systems and vendor access through a monitored route. The organization is a teaching example, so every score illustrates the method rather than a real environment.

Focus area
Cybersecurity and information security operations
Setting
Security operations for a mid-sized organization with internal IT, cloud-hosted services and outsourced support providers
Method
Five by five likelihood and impact risk register with residual review

Scope

This assessment covers the security operations function of a mid-sized organization, including monitoring, identity and access management, vulnerability handling, incident response, backup and recovery, privacy duties and oversight of third-party services. It does not assess the security of any real network, product or provider. The organization, its sector, its jurisdiction and its technology stack are not specified, so they are labeled as assumptions made for teaching only.

Context

The organization has a small security operations team, an internal IT group and a service desk. Most business applications run in a cloud environment, with some legacy systems on premises. A managed service provider monitors part of the network and a software vendor supplies the main customer platform. Staff use laptops and phones, with remote access through a virtual private network and single sign in. Each risk is scored before controls to show its natural level, then scored again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to protect the confidentiality, integrity and availability of information, detect threats early, respond to incidents in a controlled way, and meet privacy and contractual duties. The assets in scope are identity accounts, endpoints, servers and cloud services, the business data they hold, backup copies, logs and the security tools that watch them. Stakeholders include the security operations team, system owners, the service desk, staff and customers whose data is held, third party providers, the data protection officer, legal advisers and the board. Clear ownership matters: every risk has one owner role, and the security operations manager reports the register to the board each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H04 H07 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H03
3 Possible Likelihood 3, impact 4, score 12, high: H02 H05 H06
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H07 Likelihood 3, impact 3, score 9, medium: H01
2 Unlikely Likelihood 2, impact 2, score 4, low: H08 Likelihood 2, impact 3, score 6, medium: H02 H04 H05 H06 Likelihood 2, impact 4, score 8, medium: H03
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Third-party and supply-chain compromise 16 High 9 Medium Supplier risk manager
H02 Service disruption and slow recovery 12 High 6 Medium Service continuity lead
H03 Unauthorized access and identity compromise 20 Critical 8 Medium Identity and access manager
H04 Vulnerabilities and misconfiguration 12 High 6 Medium Vulnerability management lead
H05 Logging gaps and slow incident response 12 High 6 Medium Security operations manager
H06 Privacy and compliance duties not met 12 High 6 Medium Data protection officer
H07 Phishing and malware delivery 12 High 6 Medium Security awareness lead
H08 Insider misuse and data leakage 8 Medium 4 Low Head of people operations
H01

Third-party and supply-chain compromise

Supplier Before 16 After 9

A managed service provider, software vendor or cloud host with privileged access to systems is itself breached, or its update channel carries malicious code, exposing the organization's data and services to attack.

Who or what is affected: Customers, staff, service desk and data owners

Causes

Privileged vendor access, limited visibility into subcontractors and heavy reliance on a few providers.

Consequences

Data exposure, service outage, contract disputes and loss of customer trust.

Existing controls

  • Contracts include security clauses and data location terms.
  • Vendor access is limited to named accounts with approval.

Control gaps

Subcontractor chains are not mapped and vendor logs are not fed into central monitoring.

Additional controls

  • Prevent: Require vendor access through a monitored jump host with time limited sessions.
  • Detect: Review vendor security evidence each year and track unusual vendor account activity.
Likelihood 4 x impact 4 before; 3 x 3 after Owner: Supplier risk manager Target: Within 60 days Early warning: A vendor account used outside its agreed hours or from an unknown location.
H02

Service disruption and slow recovery

Operational Before 12 After 6

A ransomware event, failed change, hardware fault or denial of service attack stops key systems, and backups cannot be restored within the time the business allows.

Who or what is affected: Business units, customers and the service desk

Causes

Single points of failure, untested backups and changes made without a rollback plan.

Consequences

Lost revenue, missed deadlines, data loss and strain on staff.

Existing controls

  • Nightly backups are copied to a separate location.
  • An on-call rota covers core systems outside office hours.

Control gaps

Restore tests cover only small files, and recovery times are estimated rather than measured.

Additional controls

  • Recover: Test restores of critical systems each quarter and record the time taken against the agreed target.
  • Prevent: Apply change approval and a tested rollback plan to every production change.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Service continuity lead Target: Within 45 days Early warning: A restore test that exceeds the agreed recovery time for a critical system.
H03

Unauthorized access and identity compromise

Technology and data Before 20 After 8

Stolen or guessed credentials, session token theft or excessive standing privilege let an attacker sign in as a legitimate user and move to sensitive systems without being challenged.

Who or what is affected: Staff, administrators, data subjects and system owners

Causes

Password reuse, standing privileges that are never removed and token theft from unmanaged devices.

Consequences

Data theft, altered records, lateral movement and loss of control over systems.

Existing controls

  • Multi-factor sign in is required for email and remote access.
  • Administrator accounts are separate from everyday accounts.

Control gaps

Service accounts use long lived passwords that are excluded from routine access reviews.

Additional controls

  • Prevent: Enforce phishing resistant multi-factor authentication for all administrator and remote access accounts.
  • Detect: Alert on impossible travel, repeated failures and new administrator grants.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Identity and access manager Target: Within 30 days Early warning: A dormant account that suddenly signs in or gains administrator rights.
H04

Vulnerabilities and misconfiguration

Technology and data Before 12 After 6

Unpatched software, open storage containers, default settings and exposed management ports create entry points that attackers can find with automated scanning and use before defenders notice.

Who or what is affected: System owners, developers and customers using exposed services

Causes

Inventory gaps, rushed deployments and patch windows that are missed.

Consequences

Intrusion, data exposure and an extended period of undetected compromise.

Existing controls

  • Critical patches are applied within a set period.
  • External scans run each month.

Control gaps

Scan results for cloud resources are reviewed only when a project closes.

Additional controls

  • Prevent: Build standard secure configurations and remove default accounts before systems go live.
  • Detect: Scan internal assets for misconfiguration and track each finding to closure with a named owner.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Vulnerability management lead Target: Within 60 days Early warning: A new internet facing service that appears without an asset record.
H05

Logging gaps and slow incident response

Operational Before 12 After 6

Logs are incomplete, kept too briefly or not reviewed, so suspicious activity is missed, and responders lack a practiced plan to contain, record and report an incident.

Who or what is affected: Security analysts, incident responders, data owners and regulators

Causes

Log sources not yet connected, alert fatigue and no clear escalation path after hours.

Consequences

Longer dwell time, weaker evidence, delayed notification and higher recovery cost.

Existing controls

  • Security logs from core systems are sent to a central store.
  • A written incident response plan names the first responders.

Control gaps

Cloud and software as a service logs are not collected, and the on-call rota has no deputy.

Additional controls

  • Detect: Build alert rules for key events and test them against past incidents each quarter.
  • Respond: Run a tabletop exercise each year and update the plan with lessons learned.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Security operations manager Target: Within 45 days Early warning: A log source that has stopped sending events for more than one day.
H06

Privacy and compliance duties not met

Legal and compliance Before 12 After 6

Personal data is collected, kept or shared beyond what is needed, or breach notices are delayed, so the organization fails its duties to individuals and to regulators in the relevant jurisdiction.

Who or what is affected: Data subjects, legal team and regulators

Causes

Unknown copies of data, unclear retention rules and rushed exports to third parties.

Consequences

Penalties, complaints, mandatory notices and loss of public trust.

Existing controls

  • A data inventory lists the main personal data stores.
  • Staff complete data protection training when they join.

Control gaps

The data inventory is not updated when systems are added or retired.

Additional controls

  • Prevent: Apply data minimization and retention rules to every new system before it is approved.
  • Respond: Keep a breach notification checklist with legal contacts and decision deadlines.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Data protection officer Target: Within 60 days Early warning: A store of personal data that is found but is not on the inventory.
H07

Phishing and malware delivery

Technology and data Before 12 After 6

Staff are tricked into opening malicious attachments, entering credentials on fake sign in pages or approving unusual payments, allowing malware to reach endpoints and spread across the network.

Who or what is affected: All staff, the finance team and customers

Causes

Convincing lures, busy staff and macros or links that are allowed by default.

Consequences

Credential theft, ransomware, payment fraud and downtime.

Existing controls

  • Email filtering blocks known malicious attachments.
  • Endpoint protection runs on all managed devices.

Control gaps

Staff who report their own mistakes are not thanked, so reporting falls off over time.

Additional controls

  • Prevent: Run simulated phishing exercises and give quick feedback to anyone who clicks a test link.
  • Detect: Provide a one click report button for suspicious messages that feeds the security team.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Security awareness lead Target: Within 30 days Early warning: A rise in user reports of lookalike sign in pages or unexpected invoices.
H08

Insider misuse and data leakage

People Before 8 After 4

A current or former employee or contractor copies, deletes or shares data without authority, either by mistake or on purpose, using legitimate access that is not watched closely enough.

Who or what is affected: Customers, colleagues and data owners

Causes

Broad access granted for convenience, weak exit checks and pressure to meet deadlines.

Consequences

Confidentiality breach, legal exposure and loss of competitive advantage.

Existing controls

  • Access is removed when staff leave.
  • Sensitive folders keep a record of who opened them.

Control gaps

Contractor accounts are not included on the leaver checklist.

Additional controls

  • Detect: Monitor bulk downloads and unusual access to sensitive folders against normal role patterns.
  • Prevent: Restrict removable media and personal cloud uploads on managed devices.
Likelihood 2 x impact 4 before; 2 x 2 after Owner: Head of people operations Target: Within 90 days Early warning: A bulk download by a user who is leaving or under review.

Rating method and evaluation

Each risk is rated on two five point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls are working. Impact is judged on data lost or exposed, time to restore service, legal exposure and harm to trust, and a risk is never rated down only because it has not happened yet. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and monitored. Owners and peers should challenge every rating, and the register is reviewed whenever an indicator reaches its threshold or after a significant incident.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Dormant accounts that sign in or gain administrator rights.Escalate to the identity and access manager at once, and suspend the account until its owner is confirmed.
Restore tests that exceed the agreed recovery time for critical systems.Escalate to the service continuity lead within one day, and to the board if two tests in a row fail.
Vendor accounts used outside agreed hours or from unknown locations.Escalate to the supplier risk manager at once, and disable the vendor session until it is verified.
Log sources that have stopped sending events for more than one day.Escalate to the security operations manager on the same day, and to the chief information officer if not restored within three days.
Open critical vulnerabilities or misconfigurations past their target date.Escalate to the vulnerability management lead when any finding is overdue, and to the system owner after 30 days.

Contingency arrangements

If a serious event occurs, such as confirmed credential theft, ransomware or a data exposure, the security operations manager activates the incident response plan and isolates affected accounts and systems. The service continuity lead restores critical services from the latest tested backup. The data protection officer and legal adviser decide on notices to individuals and regulators within the relevant jurisdiction. Affected vendors are contacted through the supplier risk manager. Evidence is preserved, and staff and customers receive clear, early and accurate updates.

Prioritized action plan

  1. Enforce phishing resistant multi-factor authentication for administrator and remote access accounts, owner identity and access manager, within 30 days.
  2. Test restores of critical systems and record measured recovery times, owner service continuity lead, within 45 days.
  3. Route all vendor access through a monitored jump host and map subcontractor chains, owner supplier risk manager, within 60 days.
  4. Connect cloud and software as a service logs to the central store and add alerts for key events, owner security operations manager, within 45 days.
  5. Run a phishing exercise and a tabletop incident drill, owner security awareness lead, within 90 days.

Conclusion

Secure operations depend on a few steady habits: strong identity checks, tested backups, managed vendor access, well tuned logs and a rehearsed response. The highest scores sit with identity compromise, supplier exposure and misconfiguration, and each has actions that lower the residual score. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real security, privacy or legal question.

Assumptions and limitations

Assumptions

  • The organization operates a mix of cloud and on premises systems managed by its own staff and by named providers.
  • Security staff have standard tools for logging, endpoint protection and vulnerability scanning in place.
  • Legal duties are described in general terms only because the jurisdiction and sector are not specified.

Limitations

  • The scores are examples for learning and do not describe any real organization or incident.
  • Security threats, privacy rules and contract terms change over time, so specialist review is needed before any real decision.
  • This is educational content and does not replace a formal site-specific assessment or advice from licensed security and legal professionals.

Related frameworks to study

  • Confidentiality, integrity and availability model
  • Least privilege principle
  • Defense in depth
  • Incident response lifecycle

Technical Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Cybersecurity and Information Security Operations course Read the best practices for this course

More Technical risk assessments

Hourly Active: 45,552 Learners