[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [5 Step Guide: How to Perform a Cyber Risk Analysis](/blog/how-to-perform-a-cyber-risk-analysis) Publish date August 31, 2025 {x} minute read # 5 Step Guide: How to Perform a Cyber Risk Analysis [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/vendor-risk-assessment-template) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Template Vendor Risk Assessment Template Free resource ### Vendor Risk Assessment Template [Download now](/resources/vendor-risk-assessment-template) No organization is impervious to [cyberattacks](https://www.upguard.com/blog/cyber-attack). But what separates resilient businesses from data breach victims is superior risk management.  Resilience is achieved through the meticulous calculation of all potential risks and the application of necessary control measures to mitigate them. In this post, we present a 4-step framework for a reliable risk management plan. ## What is a Cyber Risk? The definition of risk in [cybersecurity](https://www.upguard.com/blog/cyber-security) is the likelihood of damage to sensitive data, critical assets, finances, or reputation. These damages usually result from cyberattacks or data breaches. Not all risks are equal, some have greater criticality than others. For example, the level of risk associated with a website only displaying static information is lower than the risk associated with a web application accessing sensitive customer data. Cyber risk is calculated by considering the identified security threat, its degree of vulnerability, and the likelihood of exploitation. At a high level, this can be quantified as follows: *Cyber risk = Threat x Vulnerability x Information Value.* The terms cyber risk, [cyber threat](https://www.upguard.com/blog/biggest-cyber-threats-for-financial-services), and security threat, are used interchangeably, they both refer to the same security vulnerabilities. Some examples of cyber risks include: Examples of cyber risks include: * [Ransomware](https://www.upguard.com/blog/ransomware) * [Data leaks](https://www.upguard.com/blog/data-leak) * [Data breaches](https://www.upguard.com/blog/data-breach) * [Social engineering](https://www.upguard.com/blog/social-engineering) * [Phishing](https://www.upguard.com/blog/phishing) * [Malware](https://www.upguard.com/blog/malware) * [Insider threats](https://www.upguard.com/blog/insider-threat) * [Cyberattacks](https://www.upguard.com/blog/cyber-attack) ## How to Mitigate Cyber Risks The process of mitigating cyber risks begins by collecting data about the target ecosystem. This is achieved through risk assessments for either the internal and [third-party vendor network](https://www.upguard.com/blog/third-party-vendor). In order for these risk assessments to collect the most valuable data, they need to align with business objectives. [Cyber risks should also be considered](https://www.upguard.com/blog/what-is-cyber-risk-quantification) for short-term project objectives. Cyber risks impeded project plans, so a [cyber risk assessment process](https://www.upguard.com/blog/how-to-perform-a-cybersecurity-risk-assessment) should be a vital component of project risk management. The results of a [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk) assessment should identify all the risks associated with exposed assets. This is then followed by either a qualitative risk analysis or a quantitative risk analysis in light of a defined risk appetite. The results will establish the specifications of all necessary risk responses. [Learn how to calculate the risk appetite for your Third-Party Risk Management program.](https://www.upguard.com/blog/risk-appetite-calculation-third-party-risk-management) A qualitative risk analysis is a more popular option since it assigns risks into categories rather than a specific dollar value. This is often more preferable since security risks are faster to address by referencing their level of criticality. ## Step 1: Specify Acceptable Levels of Risk Addressing all security risks is an inefficient use of security resources and in many cases unnecessary. A more sustainable approach is to define a risk appetite to separate risks into four categories: * **Avoid - **Aim to reduce or eliminate risks by adjusting program requirements * **Accept** - Acknowledge risks without implementing controls to address them. * **Control** - Deploy efforts that minimize the impact and probability of risks * **Monitor** - Monitor risks for any changes in severity This will also ensure the most critical threats are addressed first, keeping [security posture's](https://www.upguard.com/blog/security-posture) as high as possible during the most tender process of cybersecurity  - [digital transformation](https://www.upguard.com/blog/digital-risk). [Learn how to calculate risk appetite and residual risk.](https://www.upguard.com/blog/residual-risk) Risk thresholds differ between assets. It's therefore important to have all exposed assets identified so that their unique thresholds can be assigned to each of them. Digital footprint mapping will help you identify all relevant assets and their potential risks. [Learn how to create a digital footprint.](https://www.upguard.com/blog/how-to-map-your-digital-footprint) ## Step 2: Choose a Risk Assessment Risk assessments have two primary objectives:  1. To identify all risks in a target environment. 2. To keep stakeholders and decision-making project team members informed of the security process. There are many risk assessment standards to choose from. Some are mandatory for highly regulated sectors to ensure resilience for [industry-specific risks](https://www.upguard.com/industries/healthcare). Here's a list of popular assessment standards: * [NIST (National Institute of Standards and Technology)](https://www.upguard.com/blog/nist-cybersecurity-framework) * [CIS Controls (Center for Internet Security Controls)](https://www.upguard.com/blog/cis-controls) * ISO (International Organization for Standardization) * HIPAA (Health Insurance Portability and Accountability Act) / HITECH Omnibus Rule * PCI-DSS (The Payment Card Industry Data Security Standard) * [GDPR (General Data Protection Regulation)](https://www.upguard.com/blog/how-to-be-gdpr-compliant) * [CCPA (California Consumer Privacy Act)](https://www.upguard.com/blog/what-is-the-ccpa) * [AICPA (American Institute of Certified Public Accountants)](https://www.upguard.com/blog/soc-2) * [SOX (Sarbanes-Oxley Act)](https://www.upguard.com/blog/sox-compliance) * [COBIT (Control Objectives for Information and Related Technologies)](https://www.upguard.com/blog/cobit) * [GLBA (Gramm-Leach-Bliley Act)](https://www.upguard.com/blog/glba) * [FISMA (Federal Information Security Modernization Act of 2014)](https://www.upguard.com/blog/fisma) * FedRAMP (The Federal Risk and Authorization Management Program) * [FERPA (The Family Educational Rights and Privacy Act of 1974)](https://www.upguard.com/blog/ferpa-compliance-guide) * [ITAR (International Traffic in Arms Regulations)](https://www.upguard.com/blog/itar-compliance) * COPPA (Children’s Online Privacy Protection Rule) * [NERC CIP Standards (NERC Critical Infrastructure Protection Standards](https://www.upguard.com/blog/nerc-cip) Each of these assessments can be created manually from an [assessment template](https://www.upguard.com/blog/vendor-risk-assessment-questionnaire-template). For a high-level vendor assessment, this [checklist can be used](https://www.upguard.com/blog/ciso-checklist-vendor-risk-management). if your requirements do not align with any of the above standards, you can design your own assessment with a [custom questionnaire builder](https://www.upguard.com/blog/overview-custom-questionnaire-builder). To speed up the risk analysis process, a security risk management tool such as UpGuard can be used.  UpGuard manages the creation and distribution of all risk assessments, as well as any required response efforts for identified risks. The following questionnaires are available on the UpGuard platform: 1. CyberRisk Questionnaire 2. [ISO 27001](https://www.upguard.com/blog/what-is-iso-27001) Questionnaire 3. Short Form Questionnaire 4. NIST Cybersecurity Framework Questionnaire 5. PCI DSS Questionnaire: 6. California Consumer Privacy Act (CCPA) Questionnaire 7. Modern Slavery Questionnaire: 8. Pandemic Questionnaire 9. Security and Privacy Program Questionnaire 10. Web Application Security Questionnaire 11. Infrastructure Security Questionnaire 12. Physical and Data Centre Security Questionnaire: 13. COBIT 5 Security Standard Questionnaire 14. ISA 62443-2-1:2009 Security Standard Questionnaire 15. ISA 62443-3-3:2013 Security Standard Questionnaire 16. GDPR Security Standard Questionnaire 17. CIS Controls 7.1 Security Standard Questionnaire 18. [NIST SP 800-53](https://www.upguard.com/blog/nist-sp-800-53) Rev. 4 Security Standard Questionnaire 19. SolarWinds Questionnaire 20. Kaseya Questionnaire To see how these assessments are managed in the UpGuard platform, [click here for a free trial](https://www.upguard.com/demo). ## Step 3: Prioritize Risks All unacceptable risks should be further ranked by level of criticality. This can be achieved through a risk matrix that plots the likelihood of any risk being exploited by threat actors and the impact on sensitive resources if it occurs. All of the potential hazards and risk scenarios identified through[ security questionnaires](https://www.upguard.com/blog/top-vendor-assessment-questionnaires) and risk assessments should then be analyzed through such a risk matrix and assigned a corresponding risk score. > identified vulnerabilities with a critical risk level should be prioritized in incident response efforts since they will have the greatest negative impact on your organization’s security and business operations if exploited. This will differentiate high risks from those with a lower risk probability, setting the foundation for a more efficient remediation program. [Learn how to choose the best cyber risk remediation tool >](https://www.upguard.com/blog/choosing-cyber-risk-remediation-software) For more information about designing an efficient remediation program, read this [risk remediation planning whitepaper](https://www.upguard.com/resources/whitepaper-risk-remediation-planning) from UpGuard. A variation of this classification strategy can also be applied to third-party risks to optimize [vendor risk management](https://www.upguard.com/blog/vendor-risk-management) - a process known as [vendor tiering](https://www.upguard.com/blog/what-is-vendor-tiering).  ## Step 4: Implement Security Controls With hazard identification complete, security controls can then be implemented for all types of risk that require management. The effectiveness of each risk management process should be monitored with security scores, which evaluate security postures [based on multiple attack vectors](https://www.upguard.com/blog/security-posture).  A security score drop could be indicative of new risks that should then be fed through steps 3 and 4 of this framework. > Multi-Factor Authentication is the most basic and one of the most effective forms of access control that should be deployed throughout your IT Infrastructure. ## How to Mitigate Cyber Risks with UpGuard UpGuard's comprehensive attack surface monitoring engine discovers potential risks and cybersecurity threats in your IT security both internally and throughout the vendor network. This risk management solution also manages the remediation process for all discovered risks, helping organizations address vulnerabilities before they're discovered by cyberattacks. UpGuard equips security teams with multiple features that work together to increase the efficacy of your cybersecurity program, including: * Risk mitigation workflows * Information asset discovery * Information security risk management * Risk assessment report templates * Vulnerability assessment workflows * Potential threat discovery * Potential impact analysis for selected remediation tasks. * Trusted security rating methodology * VRM initiatives to secure service providers * Step-by-step guidance on securing sensitive information for third-party risk management frameworks. Template Vendor Risk Assessment Template Free resource ### Vendor Risk Assessment Template [Download now](/resources/vendor-risk-assessment-template) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)