Preparing your learning space...
64% through Projects tutorials
In this project, you will conduct a comprehensive risk assessment for a small to medium-sized business. You'll identify assets, threats, and vulnerabilities, calculate risk levels, and recommend controls. This project teaches the systematic approach to understanding and managing cybersecurity risk.
GreenLeaf Accounting is a CPA firm with 50 employees. They handle sensitive financial data for 500+ clients. They need a comprehensive cybersecurity risk assessment to:
After completing this project, you will be able to:
RISK = Threat × Vulnerability × Impact
┌─────────────────────────────────────────────────┐
│ RISK: The potential for loss or damage │
│ when a threat exploits a vulnerability │
├─────────────────────────────────────────────────┤
│ ASSET: Something of value to the organization │
│ (data, hardware, people, reputation) │
├─────────────────────────────────────────────────┤
│ THREAT: Something that can cause harm │
│ (hacker, fire, insider, natural disaster)│
├─────────────────────────────────────────────────┤
│ VULNERABILITY: A weakness that can be exploited │
│ (unpatched software, weak passwords, │
│ unlocked doors) │
├─────────────────────────────────────────────────┤
│ CONTROL: Something that reduces risk │
│ (firewall, policy, training, insurance) │
└─────────────────────────────────────────────────┘
| Framework | Best For | Key Features |
|---|---|---|
| NIST SP 800-30 | US government, general | Comprehensive, 9-step process |
| ISO 27005 | International, ISO 27001 aligned | Risk management in ISMS |
| FAIR | Quantitative analysis | Financial quantification of risk |
| OCTAVE | Organizational self-assessment | Focuses on organizational risk |
| NIST CSF | Critical infrastructure | 5 functions: Identify, Protect, Detect, Respond, Recover |
| TARA | Cybersecurity control prioritization | Threat-informed approach |
CRITERIA NIST 800-30 ISO 27005 FAIR OCTAVE
─────────────────────────────────────────────────────────────
Detail level High High Very High Medium
Quantitative Optional Optional Required No
Ease of use Medium Medium Hard Easy
Time required Weeks Weeks Months Days
Output format Report Report $ Values Risk score
Best for Mature orgs ISO 27001 Finance SMBs
For this project: We'll use NIST SP 800-30 methodology (most widely used)
Step 1: SYSTEM CHARACTERIZATION
└─ Define scope, identify assets, boundaries
Step 2: THREAT IDENTIFICATION
└─ Identify relevant threat sources
Step 3: VULNERABILITY IDENTIFICATION
└─ Identify weaknesses that threats could exploit
Step 4: CONTROL ANALYSIS
└─ Identify current and planned security controls
Step 5: LIKELIHOOD DETERMINATION
└─ Rate probability of threat exploitation
Step 6: IMPACT ANALYSIS
└─ Determine consequence of successful attack
Step 7: RISK DETERMINATION
└─ Calculate risk = Likelihood × Impact
Step 8: CONTROL RECOMMENDATIONS
└─ Recommend appropriate controls
Step 9: RESULTS DOCUMENTATION
└─ Create risk assessment report
Step 1: IDENTIFY ASSETS
Step 2: IDENTIFY THREATS & VULNERABILITIES
Step 3: ANALYZE RISKS (Likelihood × Impact)
Step 4: EVALUATE CONTROLS
Step 5: RECOMMEND & REMEDIATE
| Category | Examples | Value Criteria |
|---|---|---|
| Data | Financial records, PII, IP, backups | Sensitivity, criticality |
| Hardware | Servers, workstations, networking, mobile | Replacement cost, data stored |
| Software | Applications, OS, custom tools | License cost, business dependency |
| People | Staff, contractors, vendors | Skills, knowledge, role criticality |
| Facilities | Offices, data centers, wiring closets | Physical access, infrastructure |
VALUATION METHODS:
1. Replacement Cost: Cost to replace the asset
2. Acquisition Cost: Original purchase price
3. Business Impact: Cost of asset unavailability
4. Data Value: Value of data stored/processed
5. Criticality Rating: How essential to operations
6. Regulatory Value: Compliance requirements
| Asset ID | Asset Name | Type | Owner | Value | Criticality | Location |
|---|---|---|---|---|---|---|
| A-001 | Client Financial Database | Data | IT Director | $500,000 | Critical | Server Room |
| A-002 | Email System (Exchange) | Software | IT Director | $100,000 | High | Cloud (M365) |
| A-003 | File Server (FS01) | Hardware | IT Manager | $25,000 | High | Server Room |
| A-004 | Employee Workstations | Hardware | Dept Managers | $2,000/ea | Medium | Office |
| A-005 | Network Firewall | Hardware | IT Manager | $5,000 | Critical | Server Room |
| A-006 | Backup System | Hardware | IT Manager | $15,000 | Critical | Server Room |
| A-007 | Accounting Software | Software | Finance Director | $50,000/yr | Critical | Cloud + Local |
| A-008 | Client Portal | Software | IT Director | $75,000 | Critical | Cloud (AWS) |
| A-009 | VoIP Phone System | Hardware | Office Manager | $20,000 | Medium | Server Room |
| A-010 | Physical Security System | Hardware | Office Manager | $10,000 | Medium | Entire Office |
THREAT SOURCES:
Natural/Environmental:
─ Fire, flood, earthquake, hurricane
─ Power outage
─ Pandemic (workforce availability)
Human — Accidental:
─ Employee error (misconfiguration, data deletion)
─ Falling for phishing
─ Lost/stolen device
─ Improper data disposal
Human — Intentional:
─ External: Hackers, cybercriminals, nation-states
─ Internal: Disgruntled employees, insider threats
─ Social engineering, fraud
Technical:
─ Hardware failure
─ Software bugs
─ Network outage
─ Supply chain compromise
| Threat ID | Threat | Source | Target Assets | Likelihood |
|---|---|---|---|---|
| T-001 | Ransomware attack | External criminal | A-001, A-003, A-006 | High |
| T-002 | Phishing attack | External criminal | A-004 (users) | Very High |
| T-003 | Insider data theft | Internal employee | A-001, A-008 | Medium |
| T-004 | DDoS attack | External hacker | A-005, A-008 | Medium |
| T-005 | Hardware failure | Technical | A-003, A-005, A-006 | Medium |
| T-006 | Natural disaster | Environmental | A-001, A-003 | Low |
| T-007 | Unauthorized physical access | External/intruder | A-001, A-009 | Low |
| T-008 | Software vulnerability exploit | External hacker | A-002, A-007 | High |
| T-009 | Data exfiltration (cloud) | External hacker | A-002, A-008 | Medium |
| T-010 | Credential theft | External criminal | A-001, A-002 | Very High |
| Method | Description | Best For |
|---|---|---|
| Automated Scanning | Nessus, Qualys, OpenVAS | Technical vulnerabilities |
| Penetration Testing | Manual exploitation | Deep security validation |
| Policy Review | Document analysis | Administrative gaps |
| Interview | Staff discussions | Process/practice gaps |
| Observation | Physical walk-through | Physical security gaps |
| Audit | Compliance checklist | Regulatory compliance |
| Threat Modeling | STRIDE, PASTA | Design-level vulnerabilities |
| Vuln ID | Vulnerability | Related Threat | Severity | Existing Controls |
|---|---|---|---|---|
| V-001 | No MFA on email system | T-002, T-010 | High | Password policy only |
| V-002 | No data backup testing | T-001, T-005 | Critical | Backups exist but untested |
| V-003 | Unpatched web server | T-008 | High | Monthly patching (gap: 3 months) |
| V-004 | No access control policy | T-003, T-010 | Medium | Ad-hoc permissions |
| V-005 | No encryption on mobile devices | T-002, T-009 | High | None |
| V-006 | Single factor for VPN access | T-010 | High | VPN exists, no MFA |
| V-007 | No security awareness training | T-002 | High | None |
| V-008 | Shared admin accounts | T-003, T-010 | Medium | None |
| V-009 | No network segmentation | T-001, T-008 | High | Flat network |
| V-010 | No incident response plan | T-all | High | None |
| V-011 | Physical server room unlocked | T-007 | Medium | Key lock only |
| V-012 | Incomplete asset inventory | T-all | Medium | Partial inventory |
IMPACT SCALE:
Very Low (1) — Insignificant, no disruption
Low (2) — Minor disruption, recoverable in hours
Medium (3) — Significant disruption, days to recover
High (4) — Major disruption, weeks to recover
Very High (5) — Critical, business survival threatened
LIKELIHOOD SCALE:
Very Low (1) — <1% chance annually
Low (2) — 1-10% chance annually
Medium (3) — 10-50% chance annually
High (4) — 50-90% chance annually
Very High (5) — >90% chance annually
RISK = Likelihood × Impact
LIKELIHOOD
5 │ 5 10 15 20 25
4 │ 4 8 12 16 20
3 │ 3 6 9 12 15
2 │ 2 4 6 8 10
1 │ 1 2 3 4 5
└───────────────────
1 2 3 4 5
IMPACT
RISK LEVELS:
1-5 → Low (Green)
6-10 → Medium (Yellow)
11-16 → High (Orange)
17-25 → Critical (Red)
RISK: Ransomware Attack on Client Financial Database
Threat: T-001 — Ransomware attack
Vulnerability: V-002 — No data backup testing
Asset: A-001 — Client Financial Database ($500,000)
LIKELIHOOD: 4 (High)
- Ransomware is prevalent in accounting sector
- Multiple recent attacks on CPA firms
- No email filtering or endpoint protection
IMPACT: 5 (Very High)
- 500+ client financial records impacted
- Regulatory fines (IRS, state)
- Business could fail if data unrecoverable
- Average ransomware recovery: $1.85M
RISK SCORE = 4 × 5 = 20 (CRITICAL)
EXISTING CONTROLS:
- Antivirus on workstations (not EDR)
- Daily backups (but never tested)
- User awareness (no formal training)
RESIDUAL RISK SCORE: 15 (still High)
| Risk ID | Threat | Asset | Likelihood | Impact | Risk Score | Level |
|---|---|---|---|---|---|---|
| R-001 | Ransomware | A-001 Client DB | 4 | 5 | 20 | CRITICAL |
| R-002 | Phishing → Credential theft | A-002 Email | 5 | 4 | 20 | CRITICAL |
| R-003 | Data exfiltration | A-008 Client Portal | 3 | 5 | 15 | HIGH |
| R-004 | Unpatched vulnerability exploit | A-007 Accounting SW | 4 | 3 | 12 | HIGH |
| R-005 | Hardware failure | A-003 File Server | 3 | 4 | 12 | HIGH |
| R-006 | Insider data theft | A-001 Client DB | 3 | 4 | 12 | HIGH |
| R-007 | DDoS attack | A-008 Client Portal | 3 | 3 | 9 | MEDIUM |
| R-008 | Natural disaster | A-001, A-003 | 2 | 5 | 10 | MEDIUM |
| R-009 | Physical access | A-001 (server room) | 2 | 4 | 8 | MEDIUM |
| R-010 | VoIP system failure | A-009 Phone System | 2 | 2 | 4 | LOW |
IMPACT
1 2 3 4 5
┌────────────────────
1 │ ──── │R-010│
│ │LOW │ └─────┘
2 │ ──── R-009 R-008
L │
I 3 │ R-007 R-006 R-003
K │ R-005
E 4 │ ├─────┤
L │ │HIGH │ R-001
I 5 │ ├─────┤ R-002
H │ R-004 │
O │ │CRITI│
O │ │CAL │
D │ └─────┘
1. AVOID
── Eliminate the risk by avoiding the activity
── Example: Stop using a vulnerable legacy system
── When: Risk outweighs benefit
2. MITIGATE / REDUCE
── Reduce likelihood or impact through controls
── Example: Implement MFA to reduce credential theft
── When: Risk can be reduced to acceptable level
3. TRANSFER / SHARE
── Shift risk to another party
── Example: Cyber insurance, outsourced security
── When: Another party can manage risk better
4. ACCEPT
── Acknowledge risk without action
── Example: Accept low residual risk
── When: Cost of control exceeds risk, or within risk appetite
| Risk ID | Current Score | Strategy | Action | Target Score | Residual Level |
|---|---|---|---|---|---|
| R-001 | 20 | Mitigate | Implement EDR, test backups, patch management | 8 | Medium |
| R-002 | 20 | Mitigate | Enable MFA, SPF/DMARC, security training | 6 | Medium |
| R-003 | 15 | Mitigate | Web app firewall, DLP, encryption at rest | 6 | Medium |
| R-004 | 12 | Mitigate | Automated patching, vulnerability scanning | 6 | Medium |
| R-005 | 12 | Mitigate | RAID configuration, HA failover, warranty | 6 | Medium |
| R-006 | 12 | Mitigate | Access reviews, PAM, logging & monitoring | 6 | Medium |
| R-007 | 9 | Transfer | DDoS protection service (Cloudflare) | 3 | Low |
| R-008 | 10 | Transfer | Business interruption insurance, cloud DR | 4 | Low |
| R-009 | 8 | Mitigate | Biometric access control, CCTV | 4 | Low |
| R-010 | 4 | Accept | Continue without additional controls | 4 | Low |
ADMINISTRATIVE CONTROLS (Policies & Procedures):
─ Security policy
─ Acceptable use policy
─ Incident response plan
─ Business continuity plan
─ Security awareness training
─ Background checks
─ Access control policy
TECHNICAL CONTROLS (Technology):
─ Firewall / NGFW
─ Endpoint protection (EDR)
─ Multi-factor authentication
─ Encryption (at rest and in transit)
─ SIEM / Log management
─ Intrusion detection / prevention
─ Vulnerability management
─ Backup and recovery
PHYSICAL CONTROLS (Environment):
─ Server room access control
─ CCTV monitoring
─ Locked wiring closets
─ Fire suppression
─ Uninterruptible power supply
─ Environmental monitoring
─ Visitor management
CRITICAL (0-30 days):
[ ] Enable MFA for all systems (email, VPN, cloud)
[ ] Implement automated patching for critical systems
[ ] Test and verify backup restoration
[ ] Deploy endpoint detection and response (EDR)
[ ] Change all default passwords
HIGH (30-90 days):
[ ] Implement network segmentation
[ ] Deploy email security with DMARC enforcement
[ ] Conduct security awareness training
[ ] Implement privileged access management
[ ] Deploy SIEM for centralized logging
[ ] Create incident response plan
[ ] Implement data encryption
MEDIUM (90-180 days):
[ ] Vulnerability scanning program
[ ] Penetration testing
[ ] Access control reviews (quarterly)
[ ] DR/BCP testing
[ ] Vendor risk management
[ ] Cyber insurance review
LOW (180+ days):
[ ] Security awareness gamification
[ ] Bug bounty program
[ ] Advanced threat hunting
[ ] Zero Trust architecture
COVER PAGE:
Risk Assessment Report — GreenLeaf Accounting
Date: July 2026
Classification: CONFIDENTIAL
1. EXECUTIVE SUMMARY
1.1 Purpose
1.2 Scope
1.3 Key Findings
1.4 Overall Risk Rating
1.5 Top Recommendations
2. METHODOLOGY
2.1 Framework Used (NIST SP 800-30)
2.2 Assessment Team
2.3 Assessment Timeline
2.4 Tools and Techniques
3. ASSESSMENT SCOPE
3.1 Systems and Assets Assessed
3.2 Boundaries and Exclusions
3.3 Key Stakeholders
4. ASSET INVENTORY
4.1 Critical Assets
4.2 Asset Valuation
5. THREAT & VULNERABILITY ANALYSIS
5.1 Threat Sources
5.2 Vulnerabilities Identified
5.3 Control Effectiveness
6. RISK ANALYSIS RESULTS
6.1 Risk Register
6.2 Risk Heat Map
6.3 High and Critical Risks Detail
7. RISK TREATMENT
7.1 Treatment Strategy
7.2 Recommended Controls
7.3 Implementation Timeline
8. RESIDUAL RISK
8.1 Acceptable Risk Level
8.2 Residual Risk Register
9. APPENDICES
A. Detailed Risk Register
B. Vulnerability Scan Results
C. Control Evidence
D. Third-Party Risk
═══════════════════════════════════════════════════════════
RISK ASSESSMENT REPORT — EXECUTIVE SUMMARY
═══════════════════════════════════════════════════════════
To: Board of Directors, GreenLeaf Accounting
From: Risk Assessment Team
Date: July 22, 2026
PURPOSE
This risk assessment evaluated the cybersecurity risks facing
GreenLeaf Accounting. The assessment covered 12 key assets,
10 identified threats, and 12 vulnerabilities.
OVERALL RISK RATING: HIGH
KEY FINDINGS
┌──────────────────────────────────────────────────────────┐
│ Priority 1: RANSOMWARE │
│ Risk Score: 20 (CRITICAL) │
│ Gap: No tested backups, no EDR, no MFA │
│ │
│ Priority 2: PHISHING / CREDENTIAL THEFT │
│ Risk Score: 20 (CRITICAL) │
│ Gap: No MFA, no DMARC, no security training │
│ │
│ Priority 3: DATA EXFILTRATION │
│ Risk Score: 15 (HIGH) │
│ Gap: No DLP, no encryption requirements │
└──────────────────────────────────────────────────────────┘
TOP RECOMMENDATIONS
1. Implement MFA on ALL systems (30 days)
2. Test and improve backup procedures (30 days)
3. Deploy EDR on all endpoints (60 days)
4. Implement security awareness training (60 days)
5. Create incident response plan (90 days)
UPDATE SCHEDULE: Next assessment in 12 months
───────────────────────────────────────────────────────────
RISK ASSESSMENT DASHBOARD
─────────────────────────────────
Overall Risk Level: HIGH
RISK DISTRIBUTION:
Critical (17-25): 2 risks (20%)
High (11-16): 4 risks (40%)
Medium (6-10): 3 risks (30%)
Low (1-5): 1 risk (10%)
TOP RISKS BY SCORE:
████████████████████ R-001 Ransomware (20)
████████████████████ R-002 Phishing (20)
███████████████ R-003 Data Exfil (15)
███████████████ R-006 Insider (12)
███████████████ R-004 Unpatched (12)
CONTROL MATURITY: LOW (35%)
Process controls: 30% mature
Technical controls: 35% mature
Physical controls: 40% mature
COMPLIANCE STATUS: AT RISK
IRS Safeguards: Not fully compliant
State breach notification: Partial
Cyber insurance requirements: Partial
| Aspect | Qualitative | Quantitative |
|---|---|---|
| Input | Expert judgment, ratings | Hard data, statistics |
| Output | Risk levels (High, Medium, Low) | Dollar values ($) |
| Time Required | Days to weeks | Weeks to months |
| Data Required | Moderate | Extensive |
| Precision | Low-Medium | Medium-High |
| Ease of Communication | Easy with management | Harder (financial concepts) |
| Best For | SMBs, first assessment | Large enterprises, compliance |
ANNUALIZED LOSS EXPECTANCY (ALE)
Single Loss Expectancy (SLE) = Asset Value × Exposure Factor
Annual Rate of Occurrence (ARO) = Expected occurrences per year
Annualized Loss Expectancy (ALE) = SLE × ARO
EXAMPLE — Ransomware:
Asset Value (Client Database): $500,000
Exposure Factor (data loss): 80%
SLE = $500,000 × 0.8 = $400,000
ARO = 0.2 (once every 5 years)
ALE = $400,000 × 0.2 = $80,000/year
Control Cost (EDR + Backups): $20,000/year
Reduced ARO with Control: 0.05 (once every 20 years)
ALE with Control = $400,000 × 0.05 = $20,000/year
Control Benefit = $80,000 - $20,000 - $20,000 = $40,000/year
ROI of Control = (Benefit - Cost) / Cost = ($60,000 - $20,000) / $20,000 = 200%
| Tool | Type | Cost | Best For |
|---|---|---|---|
| NIST CSF Online | Self-assessment | Free | NIST CSF alignment |
| FAIR-U | Quantitative analysis | Free | FAIR methodology |
| RiskWatch | Compliance assessment | Paid | Regulatory compliance |
| RSA Archer | Enterprise GRC | $$$ | Large enterprises |
| SimpleRisk | Risk management | Free/Paid | SMBs |
| Excel/Sheets | Manual tracking | Free | Simple assessments |
| OneTrust | Privacy + risk | $$$ | Integrated GRC |
| SANS Risk Template | Qualitative | Free | Quick assessments |
Risk ID,Asset,Threat,Vulnerability,Likelihood,Impact,Risk Score,Level,Treatment,Control,Residual Score,Owner R-001,"Client DB","Ransomware","No tested backups",4,5,20,Critical,Mitigate,"EDR + backup testing",8,"IT Director" R-002,"Email System","Phishing","No MFA",5,4,20,Critical,Mitigate,"MFA + training",6,"IT Director"
ORGANIZATION: GreenLeaf Accounting
DATE: July 22, 2026
ASSESSMENT TYPE: Initial cybersecurity risk assessment
FRAMEWORK: NIST SP 800-30
SCOPE: All IT systems, data, and processes
ASSESSMENT TEAM:
- [Name], Lead Risk Assessor
- [Name], IT Manager
- [Name], Operations Director
- [Name], External Security Consultant
ASSESSMENT METHODS:
- Document review (policies, procedures)
- Automated vulnerability scanning (OpenVAS)
- Staff interviews (15 employees)
- Physical walkthrough (office and server room)
- Policy and procedure analysis
- Previous audit findings review
TIMELINE:
- Planning: July 1-3
- Data collection: July 5-12
- Analysis: July 13-17
- Report creation: July 18-22
LIMITATIONS:
- No penetration testing conducted
- Third-party vendor risks not fully assessed
- Cloud provider (M365, AWS) assumed secure at provider level
OVERALL RISK RATING: HIGH
Number of critical risks: 2
Number of high risks: 4
Number of medium risks: 3
Number of low risks: 1
KEY STRENGTHS FOUND:
1. Strong physical security (keycard + CCTV)
2. Regular software updates on workstations (automated)
3. Good password policy (15 char minimum)
4. Offsite backups exist (but not tested)
KEY GAPS FOUND:
1. No multi-factor authentication (MFA)
2. No endpoint detection and response (EDR)
3. No incident response plan
4. No security awareness training
5. No tested backup restoration
6. No network segmentation
7. No DLP or data classification
8. No formal access control process
Before marking this project complete:
Save your progress and earn XP for completing tutorials.
Technology
Cyber Security & Networking
Lesson group
Projects
Progress
64% complete