Information security risks: how to assess and manage them

An information security risk is the combination of how likely a threat is to exploit a weakness and how much damage the company would take if it did. Managing risk means repeating one loop: list your assets and threats, rate likelihood and impact, make a decision on every significant risk, and revisit the rating whenever the infrastructure changes.

What an information security risk is

Risk is described by two values: how likely an event is and what it costs. Rating only one of them is pointless — a rare event that halts sales for a week is worse than daily minor glitches. ISO/IEC 27005:2022, the standard for managing information security risk, is built on that definition.

A risk itself has three parts, and removing any one of them removes the risk.

• Asset — anything of value: the customer database, contracts, the server running your accounting system, the website, mail, money in the account.
• Threat — a possible cause of an incident: an outside attacker, an employee mistake, a contractor with excessive access, hardware failure.
• Vulnerability — the weak spot a threat can use: an unpatched server, one password shared by a whole department, a management console exposed to the internet.

Impact is described through three properties of information: confidentiality — only the right people see the data; integrity — the data has not been altered or deleted; availability — the system works when it is needed. A single incident usually hits several at once: ransomware both leaks data and makes it unusable.

Which risks come up most often

What actually fires is not exotic attacks but known unpatched vulnerabilities, stolen passwords and human mistakes. Reports built on real incident investigations show the same picture year after year.

• 31% of breaches start with exploitation of a vulnerability — the leading access vector in the Verizon DBIR 2026
• 48% of breaches involve ransomware, and 69% of the victims did not pay the ransom (Verizon DBIR 2026)
• $4.99M is the global average cost of a breach, an all-time high (IBM, 2026)

The starting set of risks looks roughly the same in every company:

• a leak of the customer database or employee records;
• ransomware that stops operations and reaches the backups;
• a compromised executive mailbox and forged payment instructions;
• excessive permissions and access that was never revoked after someone left;
• a contractor or cloud service through which data walks out;
• failure of the only server that has no tested backup;
• a vulnerability in a website or API exposed to the internet.

That list is only a draft. Each line then has to become specific: which asset is hit, what it costs the company, and what already stands in the way of it happening.

How to rate a risk: likelihood and impact

Rating means two scales and one table: how likely the event is, what it costs, and the risk level where the two meet. NIST SP 800-30 Rev. 1 offers qualitative five-level scales, from very low to very high. For a company with no security team that is enough: figures in money and percentages need data it does not have anyway.

Likelihood is easier to anchor to frequency than to gut feeling.

• Very low — possible, but the industry sees almost no cases.
• Low — once every few years.
• Moderate — roughly once a year.
• High — several times a year.
• Very high — monthly or more often.

Impact is measured in terms a manager understands: direct recovery costs, hours of downtime, lost deals, legal consequences, customers walking away. The risk level comes from a matrix, and its levels are the same five used in the NIST scales.

Tip Do not argue about exact probability figures. It is enough that the whole team reads “moderate” and “high” the same way and that the scale does not shift from one risk to the next.

The risk register: what goes into it

A risk register is a table where every risk is written up well enough to assign work and check the result. Without an owner and a deadline an entry stays an observation rather than a task.

• asset: what is being protected and whose responsibility it is;
• threat and vulnerability: what can happen and through what;
• likelihood and impact on the agreed scale;
• risk level taken from the matrix;
• risk owner — the manager who makes the decision;
• the chosen decision and the specific measures;
• deadline and the person responsible for implementing them;
• residual risk after the measures and the date of the next review.

One line reads like this: “CRM with the customer database — export of the base by a departing account manager — likelihood high, impact high, risk high — owner: sales director — measures: roles and export limits, access revoked on the last working day — deadline: one month”. How that is configured inside the system is covered in the article on CRM access rights.

Example: five risks of a small online store

The exercise is clearer on a company with no security team: a website, a CRM, accounting, about ten employees, customer records and payments through payment services.

Five lines already set the order of work: updates and backups first, then access and training, while a one-day hosting outage is something the company accepts on purpose. That is the point of the exercise — not a list of fears but a queue of tasks with a price tag.

What decisions are made about a risk

Every significant risk gets one of four decisions, as named in ISO/IEC 27005:2022. The choice belongs to the risk owner, not to the system administrator: it is a decision about money and liability.

Sharing does not remove liability. The company still answers to its customers and to the authorised state body for personal data, even when a contractor runs the infrastructure and an outside team watches the events. How that service differs from tools such as SIEM and EDR is covered in the article on monitoring and incident response.

What is left after the measures is called residual risk. It goes into the register too and gets its own decision — otherwise it looks as though the measures were implemented and the risk vanished by itself.

Legal risks: what Uzbek law requires

Some risks come not from an attack but from failing to follow the law. Article 27 of the Law on Personal Data No. ZRU-547 obliges the owner and the operator to take legal, organisational and technical protection measures, and article 31 requires them to appoint a unit or an officer responsible for processing and protecting personal data.

Article 27-1, as amended by law ZRU-1125 of 26 March 2026, requires biometric and genetic data, along with data on users of telecom operators, to be stored in Uzbekistan. Databases holding such data are registered in the State Register of Personal Data Bases (article 20). Other personal data may be stored and processed abroad if one of the conditions in part three of article 27-1 is met.

In the register these become separate lines: the database is not registered, nobody has been appointed responsible, consents are missing, document scans sit in a shared folder. Liability for violations and the steps to take after a leak are covered in the article on personal data breaches, and how to assemble roles, policy and documents around all of it is in the piece on building an ISMS.

How often to review risks and who owns them

Ratings are revisited on a schedule and on events: once a year in full and immediately after any noticeable change. Infrastructure moves faster than documents — people join, services get connected, new requirements appear.

1. Once a year — a full review of the register together with the risk owners.
2. Once a quarter — a check that the agreed measures are in place and working.
3. After every incident — root cause analysis and a correction of the rating.
4. When a new system goes live or a contractor is connected — rate it before launch, not after.
5. When the law or a bank or partner requirement changes — recheck the legal risks.

The risk owner is the manager whose money and processes suffer: the sales director owns the customer database, the finance director owns the accounting system. IT implements the measures but does not decide which risk the company is willing to live with.

Mistake A register kept “for the auditors” does not work. The giveaway: not a single accepted risk and not a single missed deadline in it — which means it was never discussed with the managers.

What a risk assessment costs and how we work

The price depends on the number of systems and sites, the headcount and whether any diagrams and documents already exist. Assessing risks in-house is possible and useful, but it has a limit: your own processes look normal to you, and some weaknesses only show up in a check from the outside.

At Syntra Systems we run an information security audit from $1,200. We map what needs protecting — data, services, access. We check servers, networks, mail, websites and workstations for known vulnerabilities, look at who holds which access and what happens when an employee leaves, and assess compliance with personal data law. The outcome is a report: risk, likelihood, consequences, what to do first, plus a walk-through of the findings with your team in plain language.

Then the register gets worked down: protection of data and access from $4,000, monitoring and response under an agreed procedure from $800 a month. The full scope is on the cybersecurity for business page. To find out in practice whether a specific risk is exploitable, use penetration testing.

Frequently asked questions