Cyber security is an increasing priority for businesses of every size. In recent years, cyber attacks have risen, with half of UK businesses reporting an incident in 2023.

On top of this, criminals are using AI to exacerbate their activity. This includes increasing the volume of businesses they can target and crafting deceptive communications to trick people into sharing sensitive information.

With the risk rising, businesses need to ensure they have adequate protection. This means creating a robust security posture that covers key threats. This can enable you to avoid breaches and the associated effects on your productivity, finances and reputation.

However, having a strong security posture only comes when you understand your business’s vulnerabilities. By conducting a cyber security assessment, you’ll uncover weak points that you can seek to resolve.

We list seven steps for thoroughly assessing your cyber security posture.

Can I conduct my own risk assessment?

Yes, you can! We’ve put together a step-by-step guide which shows you all the steps when assessing your cyber security provisions in-house.

However, an assessment requires specific skills and resources. Ideally, it should be done by someone who understands the threats and the fundamentals of cyber security.

If you do not have these skills internally (as many small businesses don’t), you may benefit from bringing in an external expert to support your assessment.

7 steps to your cyber security assessment_

Step 1: Identify your critical assets_

The first step to your cyber security assessment is identifying your critical assets. This includes your hardware, software and data.

If you already have a list of these, it’s easy. If not, you’ll need to devote time to identifying your assets. This might include undertaking network mapping, inventory checking or brainstorming sessions.

Once you’ve outlined your assets, you’ll have a much better understanding of the scope of your assessment.

Step 2: Assess threats and vulnerabilities_

Cyber security is a priority due to the diverse threats and vulnerabilities that face businesses. Common threats include:

1. Phishing attacks: Deceptive emails or messages designed to trick employees into revealing sensitive information or clicking malicious links
2. Malware attacks: Software like viruses, ransomware and spyware that can steal data or hold systems hostage
3. Social engineering attacks: Manipulative tactics that criminals use to impersonate others and gain access to systems or data
4. Denial-of-Service (DoS) attacks: Overwhelming a website or server with traffic to render it unavailable for legitimate users
5. Insider threats: Malicious activity from within your organisation, such as by disgruntled employees and contractors

It’s also crucial to understand common vulnerabilities within businesses, including weak passwords, unpatched software and unsecured devices.

The exact threats you experience may vary depending on your staff, processes and industry. That’s why it’s important to spend time pinpointing the issues in your operations.

Vulnerability scanning tools and penetration testing can uncover weaknesses in your business. Scanning tools will identify weaknesses across your security posture and report them to you, while penetration testing simulates cyber attacks to see how your business responds.

Both will enable you to get a better picture of the strength of your cyber security and where your biggest vulnerabilities lay.

Step 3: Analyse identity, device and data protection_

Many of the dangers facing businesses stem from a lack of adequate protections. These cover three core areas: identity, device and data.

Identity protection

Identity protection means ensuring only authorised people have access to your sensitive data and systems. It typically requires setting strong access controls (on a need-to-know basis) and using measures like multi-factor authentication to ensure only validated users can get in.

If you do not have strong identity and access management (IAM) solutions in place, it’s a risk you need to seriously consider.

Device protection

Device protection refers to securing all endpoints across your business so criminals cannot use them for their activity.

The best way to do this is to ensure all your devices are encrypted, as this makes them useless in the hands of a criminal. Data loss prevention tools can enable you to do this.

If your devices aren’t protected, you are at substantial risk if they fall into the wrong hands.

Data protection

Another crucial element to protect is data. This especially applies to your sensitive business data and customer data.

Typically, this means classifying and segmenting your data. Classification labels data based on sensitivity, allowing you to label data which is highly private. Segmentation divides datasets into smaller, more focused groups based on shared characteristics. Together, they improve data security by prioritising protection and streamlining management.

You’ll also want to enact data security best practices, such as encryption, backup and recovery.

If your data isn’t protected, it greatly increases the likelihood of a breach. And in the event of a data loss, it’ll be much harder to recover your data.

By evaluating identity, device and data, you can better understand the risk associated with your business and find areas to improve upon.

Step 4: Evaluate risk_

Evaluating risk is one of the most core steps. It involves taking the threats and issues you have uncovered and analysing the threat level on your business.

The easiest way to assess risk is with a qualitative approach. List out the various breaches that could occur and seek to rank them by:

• Likelihood (low, medium or high): The chance that the incident could happen to your business
• Impact (low, medium or high): The damage that would occur to your business if the incident were to be successful

As you assess risk, you’ll want to create a matrix that maps out the threats, based on their likelihood and impact. This will enable you to see which you need to be most concerned about.

Step 5: Prioritise and document_

By now, you should have a better grasp of the threats facing your businesses and weak points that you need to address. The next step is prioritising actions, based on what is going to have the greatest impact.

Naturally, you’ll first want to target threats that are more likely to occur and will cause reasonable damage. These should be tackled first, then work by priority from there.

At this stage, it’s also important to document all risk scenarios. Include information on the risk level, what provisions are in place already and your plan of attack.

This risk register will allow you to keep track of the work to come and monitor progress.

Step 6: Develop an action plan_

The next stage of your cyber security assessment is creating an action plan. With a prioritised list of areas to address, you can now start resolving them.

The threat you face will dictate how you fix it. In some cases, you may need to strengthen your internal policies, such as promoting better password hygiene. Staff education may also be needed to improve your first line defences.

There is also a wide range of solutions available on the market that can reduce risk levels and tackle core areas of cyber security. Spend time researching the tools available to you. It might also be worth bringing in a consultant who can make recommendations.

Aim to put a timeline on the work required so there’s less chance of it being deprioritised.

Step 7: Monitor progress_

Cyber security isn’t a task that’s ever complete. Risk levels evolve, meaning protections may become outdated over time. You need to constantly assess, analyse and address the threat.

As you begin to implement your action plan, continue to scan for vulnerabilities to check if it’s having the right progress.

You should also consider investing in software that provides constant threat protection. You might also want to recruit team members (either internally or externally) that handle this on an ongoing basis, as a part of an always-on security operations centre.

By regularly reviewing, you’ll continue to uncover risks, allowing you to take a proactive approach to handling them.

The next steps_

Once you’ve done your cyber security assessment, it’s time to strengthen your security posture. However, this requires you to have the right tools.

Microsoft is one of the leading software providers when it comes to cyber security. Their innovative solutions include:

• Microsoft Defender XDR: A unified extended detection and response (XDR) solution that provides comprehensive threat intelligence and automated attack disruption
• Microsoft Defender for Business: Endpoint protection for small and medium-sized businesses, offering cost-effective security
• Microsoft Entra: Simplifies identity and access management by providing a single place to secure identities and access across your entire environment
• Microsoft Purview: Allows IT admins to discover, classify and protect sensitive data within their organisation
• Microsoft Intune: A cloud-based mobile device management (MDM) and enterprise mobility management (EMM) service to help you manage your endpoints and apps
• Microsoft Sentinel: A Security Information Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution, which collects security data across hybrid environments, using AI and machine learning to identify real threats

With the right solutions, you can increase your business protection and stop having to worry about the likelihood of a successful cyber attack.

Our Infinity UNBOUND: Get to Secure video series is a programme of bite-sized, expert-led sessions giving you practical advice to strength your security posture. Covering the current threat landscape and modern solutions to help, you’ll gain actionable guidance to protect your business.