Risk assessment is the activity that turns security from a checklist into a rational programme. Without it, controls are chosen because they are familiar, because a vendor recommended them, or because a framework demands them — but no one has asked whether they address the risks that actually matter to this organisation. A risk assessment forces that question. It asks what the organisation is trying to protect, what could go wrong, how likely that is, how bad it would be, and what should therefore be done. The output is a prioritised set of risks that drives the security roadmap.
The mechanics vary by standard but share a common shape. The organisation identifies its assets — the information, systems, and processes that matter — and the threats that could affect them (external attackers, insiders, natural events, supply-chain compromise). For each asset-threat pairing, it identifies the vulnerabilities that could be exploited and estimates the likelihood and impact of a successful exploitation, producing a risk level. Risks are then evaluated against the organisation's risk appetite and prioritised for treatment: mitigated by controls, transferred (for example, to insurance), avoided by discontinuing an activity, or accepted with documented justification.
The quality of a risk assessment depends on the inputs and on intellectual honesty. A risk assessment that uses generic threat lists, ignores the organisation's specific context, or is shaped to justify decisions already made adds little value. A good assessment draws on the organisation's actual environment, real threat intelligence, knowledge of prior incidents and near-misses, and the business context that determines real impact. It is also honest about uncertainty: where likelihood or impact cannot be precisely quantified, the assessment says so rather than producing false precision. Methodologies like ISO 31000 and the NIST Risk Management Framework provide the structure; the judgement is human.
Risk assessment is a regulatory and standards expectation as well as a management discipline. ISO 27001 requires a risk assessment as the engine of the ISMS and requires the organisation to select controls based on its results. NIS2 explicitly requires risk-management measures based on a risk assessment. SOC 2, PCI DSS, HIPAA, and DORA all require risk assessment in some form. An organisation pursuing any of these will be doing risk assessment work, and a single well-executed assessment can serve several frameworks — which is why it is usually one of the first activities in a compliance programme.
Passeca conducts risk assessments aligned to ISO 31000 and the NIST RMF, producing a risk register, treatment plan, and the documentation needed for ISO 27001, NIS2, and other frameworks. The assessment draws on threat intelligence from Signals, vulnerability and exposure data from the relevant platforms, and the organisation's own context to produce a prioritised, defensible view of risk. The output is not a one-time document but a living register that is reviewed as the environment, threats, and business change — which is the difference between a risk assessment done for compliance and one done for security.