I have to add provide a draft of a risk assessment for a small EU project. As I've never done this, I struggle with identifying assets or vulnerabilities. I'm aware of very general lists, but I wonder how relevant it is to point out that fire is a danger for servers (especially as we don't have any information about hosting yet)? Shouldn't it be more specific for our web application?

What would probably help me a lot is an example. Does anyone know where to find one?

  • What have you researched? google.com/search?q=cyber+risk+assessment+EU+standard and google.com/search?q=cyber+risk+assessment+of+web+based+service and ncsc.gov.uk/collection/risk-management/… there are numerous frameworks, approaches, and examples online for all you've asked for. "Lists" of risks or borrowing other people's Risk Registers is not what you need to do. You need to engage the process.
    – schroeder
    Commented Jul 21, 2023 at 9:43
  • It looks like your first step is to define your scope. Fire is a physical or environmental threat. Are those in scope?
    – schroeder
    Commented Jul 21, 2023 at 9:45
  • They don't define a scope. They just ask for a “draft IT security risk assessment”.
    – sk904861
    Commented Jul 21, 2023 at 13:04
  • 1
    Right - you need to define your scope... Once you define it, you can be transparent about it and refine your work to identify risks to assess. Settlng a scope is always step 1.
    – schroeder
    Commented Jul 21, 2023 at 13:17


You must log in to answer this question.

Browse other questions tagged .