Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
A cybersecurity risk assessment answers three questions: what does the business own, what could reach it, and how bad would the impact be. Done well, it produces a scored risk register an insurer, board, or PIPEDA reviewer can read without translation. This playbook walks the seven-step methodology Fusion Computing runs on Canadian SMB engagements. If you want it done for you, our cyber risk assessment delivers the scored register as a fixed-scope engagement.
KEY TAKEAWAYS
- A cybersecurity risk assessment scores findings by likelihood and impact to produce a prioritized risk register, then maps that register to controls.
- Most Canadian SMBs use NIST SP 800-30 r1 as the methodology, NIST CSF 2.0 as the program spine, and the Canadian Centre for Cyber Security baseline controls as the local floor.
- The seven steps run two to four weeks: asset inventory, threat identification, vulnerability identification, likelihood and impact scoring, risk register, treatment plan, reporting and re-assessment.
- A risk assessment is broader than a vulnerability scan or penetration test; the three artifacts answer different questions and stack on each other.
- Scored risk registers mapped to NIST CSF 2.0 are what cyber-insurance underwriters and Canadian privacy regulators ask for first.
Book a Cybersecurity Risk Consultation
What is a cybersecurity risk assessment? The definition, explained
A cybersecurity risk assessment scores what could go wrong, and how badly. The process identifies assets, threats, and vulnerabilities, rates each finding by likelihood and impact, and produces a prioritized risk register with recommended controls. NIST SP 800-30 r1 defines it as determining the probability and magnitude of harm to operations. ISO 27005:2022 frames the same work as the bridge between asset value and treatment decisions.
The output is a register listing each risk, its score, its current control, and a target date. Two adjacent artifacts get confused with the assessment, and PIPEDA reviewers ask for all 3. If you would rather skip the internal build, ask us to run the register for you.
Risk assessment vs vulnerability assessment vs pen test
According to Statistics Canada (2024), 16 percent of Canadian businesses absorbed a cyber security incident in 2023. Large firms took the highest rate at 30 percent, not the smallest ones. Small and medium firms are hit less often per business and carry it with the thinnest security bench, which is why the scored register matters more than the scanner output.
A vulnerability assessment enumerates CVEs across hosts, applications, and cloud services, typically 200 to 900 findings on a first Canadian SMB scan. A penetration test proves which of those CVEs an attacker can chain into business impact. A risk assessment sits above both: it scopes which assets matter, scores findings against business consequences, and produces the register an insurer or auditor signs off on.
| Artifact | Question answered | Typical tooling |
|---|---|---|
| Risk assessment | What is the prioritized list of business risks and their treatments? | Risk register, NIST CSF 2.0 control map, Power BI dashboard |
| Vulnerability assessment | Which CVEs and misconfigurations exist on which assets right now? | Microsoft Defender Vulnerability Management, Tenable Nessus, Qualys |
| Penetration test | Which of those weaknesses can an attacker actually exploit to reach data? | Manual red-team, OffSec-certified tester, scoped engagement |
Run a security vulnerability assessment first, feed it into the risk assessment scored against CIS Controls v8.1, then commission network penetration testing against the highest-scored items.
If you are still building the internal argument for the assessment itself, start with why cybersecurity is important for Canadian businesses.
The seven-step risk assessment methodology: scope, criteria, and steps
According to a peer-reviewed study of Microsoft Azure Active Directory accounts (2023), multi-factor authentication cut compromise risk by 99.22 percent. The same analysis measured a 98.56 percent reduction on accounts whose credentials had already leaked. Admin MFA is the single highest-impact line most Canadian SMB registers surface, and enforcing it in Microsoft Entra ID costs a licence you already own.
NIST SP 800-30 r1 organizes the work into preparing, conducting, and maintaining the assessment. Translated for Canadian SMBs, that becomes seven concrete steps: asset inventory, threat identification, vulnerability identification, likelihood and impact scoring, risk register, treatment plan, reporting and re-assessment. The Canadian Centre for Cyber Security baseline controls slot into steps 4 and 6 as the local floor.
| Step | Activity | Output |
|---|---|---|
| 1. Asset inventory | Catalog hardware, software, SaaS, data stores; tag criticality | Asset register with criticality ratings |
| 2. Threat identification | Map relevant threat actors and scenarios per asset | Threat catalog tied to assets |
| 3. Vulnerability identification | Run scans, review configurations, interview owners | CVE list, misconfiguration list, process gaps |
| 4. Likelihood and impact scoring | Apply 5×5 matrix per finding | Composite scores 1 to 25 |
| 5. Risk register | Document asset, threat, vulnerability, score, owner | Single source of truth artifact |
| 6. Treatment plan | Decide accept, mitigate, transfer, or avoid per risk | Prioritized roadmap with owners and dates |
| 7. Reporting and re-assessment | Executive readout, schedule next review | Board-ready report, cadence calendar |
Step 1: Asset inventory and criticality
Start with a complete inventory of hardware, software, SaaS tenants, identity providers, and data stores. Tag each entry with a criticality rating (high, medium, low) based on revenue impact, regulatory exposure, and recovery time tolerance. Pull device data from RMM, identity data from Microsoft Entra ID, and SaaS data from Microsoft Purview. Skipping inventory work is the most common reason assessments miss real risks.
Working through this for your business?
Mike Pearlstein, CISSP, and the Fusion Computing team support Canadian SMBs with running a risk assessment or building a remediation plan for the gaps it surfaces. Free 30-minute consult, we will tell you what we would do.
Step 2: Threat identification
Map plausible threats to each high-criticality asset. Use a small, locally relevant catalog: ransomware operators, business email compromise actors, infostealer commodity malware, supply-chain compromise of an MSP or SaaS vendor, insider error, and physical loss. The National Cyber Threat Assessment 2025-2026 names ransomware the top cybercrime threat to Canada’s critical infrastructure, and the same playbooks reach SMB targets.
Authoritative threat sources: the Canadian Centre for Cyber Security baseline controls set the local floor at 13 controls. NIST SP 800-30 r1 is the methodology canon. CIS Controls v8.1 supplies 18 controls and 153 safeguards across three implementation groups when a prescriptive checklist is wanted.
[REGULATOR QUOTE]
“We attempt to apply the 80/20 rule (achieve 80% of the benefit from 20% of the effort) to the cyber security practices of small and medium organizations in Canada.”
Canadian Centre for Cyber Security, Baseline Cyber Security Controls for Small and Medium Organizations. Control OC.1 scopes the baseline to organizations under 499 employees.
Step 3: Vulnerability identification
Vulnerability identification combines automated scanning with configuration review and process interviews. Run Microsoft Defender Vulnerability Management or Tenable Nessus across endpoints and servers. Use Qualys or Defender for Cloud across SaaS and infrastructure. Then review identity, backup, and incident-response documentation against NIST CSF 2.0 and the CCCS baseline.
In our practice, process gaps account for roughly half of the high-scored findings on a Canadian SMB engagement. Tools surface CVEs. Interviews surface untested backups and missing admin MFA, and neither shows up in a scan report. If you want that interview run for you, book a scoping call with our Toronto team.
Step 4: Likelihood and impact scoring
Score each finding on a 5×5 matrix. Likelihood runs 1 (theoretical) to 5 (actively exploited against organizations like yours). Impact runs 1 (negligible) to 5 (business-ending). Multiply for a composite score from 1 to 25. The qualitative approach is the practical default for SMBs because most do not have the historical incident data quantitative methods require.
| Composite score | Tier | Required action |
|---|---|---|
| 20 to 25 | Critical (red) | Remediate immediately, escalate to executive sponsor. |
| 12 to 19 | High (orange) | Documented mitigation plan with owners and dates. |
| 8 to 11 | Medium (yellow) | Active monitoring, scheduled review. |
| 1 to 7 | Low (green) | Accepted with documentation. |
[FIELD NOTE] FROM MIKE
The scoring argument I have most often is about impact, not likelihood. A Toronto professional-services client wanted a legacy file server rated 3 because the hardware was healthy. It held seven years of client records with no tested restore, so the business consequence of losing it was a 5.
Score impact on what the business loses, not on how sick the box looks. Have someone outside the build team, ideally CISSP-led, sign the scoring sheet.
Step 5: Risk register
The risk register is the single document the rest of the program runs on. Each row contains the asset, threat, vulnerability, existing control, composite score, proposed treatment, accountable owner, and target date. Most Canadian SMBs maintain it in Excel or a custom Power BI dashboard tied to NIST CSF 2.0 categories, so insurers and the board read the same artifact.
Step 6: Treatment plan
Every scored risk gets one of four treatments. Mitigate means adding or strengthening a control, from MFA policy to the right firewall type. Transfer means cyber insurance or contractual indemnity. Accept means documenting and monitoring. Avoid means stopping the activity. ISO 27005:2022 calls these the four risk treatment options, and they map directly onto NIST CSF 2.0 functions Govern, Identify, Protect, Detect, Respond, and Recover.
- Mitigate the red tier first. Admin MFA, tested restores, and edge patching clear most 20-to-25 lines.
- Transfer what insurance will actually price, and read the exclusions before you count it as covered.
- Accept in writing, with a named owner and a review date. An undocumented acceptance reads as an oversight at audit.
- Avoid where the activity earns less than it risks. Retiring one legacy application often clears 5 or 6 register lines at once.
[FIELD NOTE] FROM MIKE
A Hamilton manufacturer in the 40 to 60 seat band came to us after their underwriter flagged the renewal. They had antivirus, firewall, and nightly backups, plus MFA on email but not on the Microsoft 365 global-admin role. I enforced admin MFA the same afternoon and ran a restore drill that uncovered a silent backup failure.
We moved them onto Microsoft Defender for Endpoint, and the renewal reprice landed in single digits rather than the 30-plus percent first quoted. The register, not the tooling, is what the underwriter read.
Step 7: Reporting and re-assessment
Three artifacts come out of a finished assessment: the technical risk register, an executive summary written in business risk language, and the remediation roadmap with owners and dates. Schedule the next full assessment for 12 months out; run a lightweight delta review after any material infrastructure change, security event, or insurance renewal. Continuous vulnerability scanning fills the gap between cycles.
- Technical register for the people doing the work, scored 1 to 25 with owners and dates.
- Executive summary in business-risk language, 2 pages, no CVE identifiers.
- Remediation roadmap sequenced by tier, with the red tier costed before the board sees it.
Why the register matters at renewal: the Office of the Privacy Commissioner of Canada requires safeguards proportional to data sensitivity under PIPEDA. NIST CSF 2.0 and ISO 27005:2022 are the two methodologies cyber-insurance underwriters most often ask about. A scored register mapped to either lets an SMB answer underwriter questionnaires in days, not weeks.
For a control-by-control version scaled to 10 to 200 users, see our cybersecurity assessment checklist for Canadian SMBs, which scores 8 categories against CIS Controls v8.1 IG1.
How much does a cybersecurity risk assessment cost in Canada?
Budget CA$3,000 to CA$10,000 for a scoped assessment. That band covers a 10 to 150 employee Canadian business and includes the technical risk register, the executive readout, and a remediation roadmap with owners and dates. Multi-site organizations and ISO 27001-aligned work run above it. Ongoing managed cybersecurity is priced separately, from CA$130 to CA$180 per user per month.
What moves the number is scope, not headcount. A single-tenant Microsoft 365 shop in Vancouver with one line-of-business application scopes at the bottom of the band. A Toronto professional-services firm with three offices, a legacy on-premises server, and a PIPEDA-regulated client list scopes near the top.
Mike Pearlstein, CISSP, scopes every assessment engagement personally before a number goes out. Send us your environment and we will scope it before quoting.
Common risk-assessment mistakes
Five mistakes recur across Canadian SMB engagements. Treating the assessment as a vulnerability scan and skipping process review. Letting the team that built a system also score it. Producing a register no executive can read. Scoring impact on technical severity instead of business consequence. Filing the deliverable and never running a re-assessment. Each one is avoidable when the seven steps are followed in order.
Book a 30-Minute Risk Consultation Scoping Call
Frequently asked questions
What is a cybersecurity risk assessment?
A cybersecurity risk assessment is a structured process that identifies assets, threats, and vulnerabilities, scores each finding by likelihood and impact, and produces a prioritized risk register with recommended controls. The output is broader than a vulnerability scan because it covers people, processes, and compliance obligations alongside technical CVEs. NIST SP 800-30 r1 is the most common methodology used by Canadian SMBs.
How is a risk assessment different from a penetration test?
A risk assessment scopes which assets matter and scores findings against business consequences. A penetration test actively exploits specific weaknesses to prove real-world impact. The assessment runs first. The pen test then targets the 5 to 10 highest-scored items on the register, which is how Canadian underwriters expect the 2 artifacts to stack. The two artifacts complement each other for underwriter and board reporting.
How often should a Canadian SMB run a risk assessment?
At minimum, annually. Trigger an extra assessment after a material infrastructure change (cloud migration, acquisition, new office), a security event, a regulatory change, or an insurance renewal asking for updated documentation. Regulated industries (health, finance, legal) typically run assessments every 6 to 12 months with continuous scans between cycles.
Which framework should we pick: NIST, ISO 27005, or CIS?
Most Canadian SMBs use NIST SP 800-30 r1 as the assessment methodology, NIST CSF 2.0 as the program spine for board reporting, and the Canadian Centre for Cyber Security baseline controls as the local floor. ISO 27005:2022 applies when the business pursues ISO 27001 certification or sells into enterprise customers that require it. CIS Controls v8.1 is a useful prescriptive checklist that overlays cleanly on either methodology.
What tools do you use during the assessment?
Microsoft Defender Vulnerability Management or Tenable Nessus for endpoint and server scanning. Qualys or Microsoft Defender for Cloud for cloud-side findings. Microsoft Purview for data classification and SaaS visibility. A custom risk register in Excel or Power BI for the scored output. The toolset is deliberately auditable so each register line traces back to a source.
How long does an assessment take?
Two to four weeks of elapsed time for a 10 to 150 employee Canadian SMB. Asset inventory and treatment-plan development consume the most hours; scoring goes fast once inventory is clean. Median register length on Fusion Computing engagements through Q1 2026 was 38 to 65 line items. Three weeks is the modal duration.
What does an assessment cost in Canada?
For most Canadian businesses with 10 to 150 employees, a professional assessment runs CA$3,000 to CA$10,000 depending on scope, cloud footprint, and compliance requirements. The price typically includes the technical register, executive readout, and remediation roadmap. Cost climbs above CA$10,000 for multi-site organizations or work aligned to ISO 27001 certification.
Can the internal IT team run the assessment?
Internal teams can run assessments when they have experienced security staff. The limitation is objectivity: teams sometimes carry blind spots on systems they built, and findings reflecting on their own work get softened. A practical hybrid uses the internal team for asset inventory and scanning, then brings in an external CISSP-led assessor to validate scoring and write the executive report.
Does an assessment help with PIPEDA and cyber-insurance compliance?
Yes. PIPEDA requires safeguards proportional to data sensitivity, and a documented, scored risk register is how that proportionality is demonstrated to the Office of the Privacy Commissioner of Canada. Cyber-insurance underwriters increasingly ask for the register at renewal as their first request. Pairing the assessment with a tested incident response plan covers the second most common underwriter question.
What happens after the assessment is delivered?
Execution of the treatment plan: implementing additional controls, patching critical CVEs, fixing misconfigurations, training staff on identified gaps, and scheduling the next review. Many Canadian SMBs scope a managed cybersecurity engagement at this point so there is no continuity gap between the assessment artifact and the work that follows it. Ongoing managed cybersecurity runs CA$130 to CA$180 per user per month.
What will our cyber-insurance underwriter actually ask to see?
Four artifacts, in this order: the scored risk register, proof of MFA on every privileged account, evidence of a tested restore inside the last 12 months, and a written incident response plan with named owners. Across our 60+ Canadian SMB security engagements through Q1 2026, the tested-restore evidence is the one buyers most often cannot produce. It is also the cheapest of the four to fix.
Do we need a risk assessment if we already have an MSP?
Yes, and the assessment should not be scored by the party that built the environment. An MSP contract covers operations; a risk assessment covers business exposure, including the MSP itself. The Canadian Centre for Cyber Security publishes ITSM.50.030, which sets out 10 due-diligence areas for buyers of managed services. Ask your provider to answer all 10 in writing before the next renewal.
