Cyber risk assessment
Know which risks matter, and what they would cost.
We identify the threats to your business, rate them against your controls and put a range on the loss. A short list to fund, not a long list to ignore.
CISOs, CFOs and boards deciding where the next security dollar goes.
app.resilientprivacy.com/grc/risk-register
Simulated environment, real workflow.
Maturity
Your NIST CSF 2.0 profile, today and in six months.
We score each function against the CSF 2.0 implementation tiers, then agree the target profile the plan has to reach. Toggle to see the gap close.
- Today
- After 6 months
| Area | Today | After 6 months |
|---|---|---|
| Govern | 1.5 | 3.0 |
| Identify | 2.5 | 3.0 |
| Protect | 2.5 | 3.0 |
| Detect | 1.5 | 3.0 |
| Respond | 2.0 | 3.0 |
| Recover | 1.0 | 2.5 |
Simulated environment, real workflow.
Risk register
Every risk placed by likelihood and impact.
Each risk gets an owner, a score and a treatment. The top-right cells are where the budget goes first; the rest are accepted or watched, in writing.
- Low
- Medium
- High
- Critical
Impact →
| Likelihood | Impact 1 | Impact 2 | Impact 3 | Impact 4 | Impact 5 |
|---|---|---|---|---|---|
| 5 | 0 | 0 | 1 | 1 | 1 |
| 4 | 0 | 1 | 2 | 2 | 1 |
| 3 | 1 | 3 | 3 | 2 | 1 |
| 2 | 2 | 4 | 2 | 1 | 0 |
| 1 | 3 | 2 | 1 | 0 | 0 |
Simulated environment, real workflow.
Where AI lands in Risk Assessment.
AI risk sits in the same register: model misuse, training-data exposure and third-party AI providers, rated with the same method as every other scenario.
How the assessment runs
Five steps from risk framing to a treatment plan.
- 01
Frame
Agree the scope, risk appetite and method (qualitative, quantified, or both) with leadership.
Output: Risk method
- 02
Identify
Interviews, architecture review and threat data, AI systems included, to build realistic loss scenarios.
Output: Risk inventory
- 03
Analyze
Rate likelihood and impact against existing controls; quantify the top scenarios as loss ranges.
Output: Rated risk register
- 04
Treat
Recommend treatments with cost and risk reduction, and assign owners and dates.
Output: Treatment plan
- 05
Report
A register your team maintains and a board-ready summary in plain language.
Output: Board summary
Deliverables
What you keep when we are done.
Documents and systems your team owns and runs, not a binder that goes stale.
- Risk methodology aligned to ISO 27005 or NIST
- Risk register with owners and ratings
- Quantified top scenarios with loss ranges
- Treatment plan with cost and effect
- Board and executive summary
- Annual refresh option
Typical timeline
Varies with scopeFrame
Week 1
Kickoff, scope, appetite.
Identify
Weeks 2–3
Interviews, document and architecture review.
Analyze and treat
Weeks 3–5
Ratings, quantification, treatment options.
Report
Week 6
Register hand-over and executive readout.
FAQ
Straight answers.
Qualitative or quantified?
Both have a place. Qualitative ratings cover the full register quickly; we quantify the handful of scenarios that drive budget decisions.
Does this satisfy a framework requirement?
Yes. The output meets the risk-assessment requirements in ISO 27001, SOC 2, HIPAA, PCI DSS and NIST CSF.
How often should we repeat it?
Once a year, and after a major change such as an acquisition, a new product line or a serious incident.
Who needs to be involved?
A sponsor from leadership, owners from IT, engineering and operations, and finance for the quantified scenarios.
Related
Often paired with.
Find out how close you are to audit-ready.
A 30-minute readiness conversation with a Risk & Compliance lead, scoped to the frameworks you are asked for.