List your key systems, what could go wrong, how likely and how bad it would be, and what you will do about it.
Small businesses depend on a few systems: email, payroll, POS, scheduling and time records. A simple assessment shows which failures would hurt most.
For regulated data, such as health or card data, follow the specific requirements that apply.
11 items. Fill it in on screen or print a copy.
| Field | What to write |
|---|---|
| System | Payroll and time records |
| Threat | Stolen admin password |
| Likelihood × impact | 3 × 5 = 15 |
| Action | Turn on multi-factor authentication; owner: office manager; by Dec 1 |
A restaurant group scores POS outage at 3 × 4 = 12 and payroll account takeover at 3 × 5 = 15. It turns on multi-factor authentication for payroll first, then adds offline card processing as a POS backup.
Merchants that store card data must follow the PCI DSS through their card processing agreement, and it includes periodic risk assessment. The FTC Safeguards Rule also requires a written risk assessment for businesses it covers, such as tax preparers.
| System and owner | Practice management software; owner Priya |
|---|---|
| Data held | Client contacts, cards on file, pet records |
| Threat | Ransomware from an email attachment |
| Likelihood x impact | 3 x 5 = 15 |
| Current controls | Nightly cloud backup, antivirus |
| Extra controls | Weekly offline backup, phishing training, by Jan 15 |
| Review date | July 2027 |
Stonebridge Veterinary Clinic in Albany scores ransomware at 15, so it goes ahead of a lost tablet scored 2 x 3 = 6. Priya, the practice manager, owns the system even though the vendor hosts it.
No. A spreadsheet works.
Enough to make decisions.
Owners, managers and IT.
Twice a year and after big changes.
Inherent risk is the score before any controls, and residual risk is the score after the controls you have in place. A ransomware risk might score 3 x 5 = 15 with no backups and fall to 3 x 2 = 6 once tested offline backups exist. Track both to show what your controls are worth.
Write a short definition for each number so people score the same way. For example, 1 means rare, about once in ten years, 3 means it could happen in a year, and 5 means expected several times a year. Keep the definitions at the top of the template.
More for the same job
EZTime’s digital HR forms collect e-signatures and keep the signed copy in the employee’s digital file, with reminders before a document expires. A 14-day trial needs no credit card.