Risk Assessment and Data Mapping: Know What You Have Before You Rank What Can Hurt It

Why the inventory comes before the score

You cannot rate the risk to a system you do not know you have. That sounds obvious, and it is the most common gap found when a company finally sits down to assess itself. The finance team signed up for an online expense tool two years ago. A sales rep keeps a customer spreadsheet in a personal cloud drive. A retired file server still sits under a desk, still joined to the network, still holding old payroll exports. None of it is on the IT provider's list because nobody told the IT provider.

The frameworks agree on the order. In the CIS Controls v8.1, the first three controls are Inventory and Control of Enterprise Assets (Control 1), Inventory and Control of Software Assets (Control 2) and Data Protection (Control 3). In the NIST Cybersecurity Framework 2.0, the Identify function covers asset management and risk assessment, and the Govern function sets the risk strategy that tells you how to score what you find. And the law gets there too. The FTC Safeguards Rule, which applies to a long list of non-bank financial businesses (lesson 06 covers who), requires at 16 CFR 314.4(c)(2) that you "identify and manage the data, personnel, devices, systems, and facilities" that support your business goals, and prioritize them by their importance to business objectives and your risk strategy. The HIPAA Security Rule, for health care providers, health plans and their business associates, requires an accurate and thorough assessment of risks and vulnerabilities to electronic protected health information at 45 CFR 164.308(a)(1)(ii)(A). You cannot do either without a list.

Lesson 02 laid out eleven layers of defense. Lesson 03 is how you decide how much to spend on each one. Spending without a risk assessment is guessing with a purchase order.

The asset inventory

An asset is anything the business depends on that could fail, be stolen or be misused. For a company of 10 to 500 people, six kinds of asset matter. Hardware (laptops, servers, phones, network gear, printers, badge readers, cameras). Software (installed applications and operating systems). Cloud and software-as-a-service (SaaS) accounts, such as email, accounting, payroll, customer relationship management and file sharing. Data (covered in the next section). People with privileged access, such as administrators and executives whose accounts would be the first target. And facilities, meaning offices, server closets and any place paper records are kept.

The inventory does not need special software to begin. It needs an owner for each line, which is the part that makes it useful. The table shows the minimum fields.

Where do the entries come from? Not from memory. Pull them from sources that cannot forget: the device management console or the antivirus management portal (every managed laptop appears there), the identity provider's list of connected applications, the network switch and wireless controller lists, the domain registrar and DNS records, and, for SaaS, the credit card statements and expense reports. The last one is the best shadow IT detector in a small company. Any recurring charge that nobody on the IT list recognizes is a SaaS account holding company data. Lesson 09 covers how to bring those vendors under review.

Reconcile quarterly. A device that appears in the management console but not in the inventory is a gap. A device in the inventory that has not checked in for 30 days is a lost laptop, a decommissioned machine nobody recorded or something worse. Both are findings a manager can ask for in a one-page report.

The data inventory and classification

The asset list says what you own. The data inventory says what is inside it. Start with the question "if this leaked, who would be harmed and what would we have to do about it?" That question produces five lists: customer personal information, employee and applicant records, payment card data, health information and confidential business records (contracts, pricing, source code, bids, financial statements).

Four labels are enough for most firms. More than four and staff stop using them.

Classification schemes trace back to federal practice. NIST's FIPS 199, published in February 2004 for federal systems, rates information against three security objectives, confidentiality, integrity and availability, which is why the same three words appear in nearly every risk assessment template. You do not need to adopt FIPS 199. You need a scheme staff can apply in a second.

The classification tells you which law bites. A short table makes the link a manager can use. Lessons 06 and 07 cover the laws in detail.

Data flow maps

An inventory is a list. A data flow map is a picture of movement. It follows one kind of sensitive data from the moment it enters the business to the moment it is destroyed, and it marks every place a copy rests along the way. Draw one map per major data set rather than one giant map of everything. A good map answers these questions.

• Collection: how does it come in (web form, phone, paper, email attachment, vendor feed)?
• Storage: which systems and which paper files hold a copy, including backups and the laptop on someone's kitchen table?
• Use: who sees it, and in which roles?
• Sharing: which vendors, contractors and agencies receive it, by which route?
• Retention: how long is each copy kept, and who decided?
• Disposal: how is each copy destroyed, and who confirms it?

The dashed boxes are where audits and breaches find data. Every copy you cannot account for is a copy you cannot protect, patch, encrypt or delete. The FTC Safeguards Rule goes as far as requiring that covered businesses dispose of customer information no later than two years after the last date it is used for the product or service in question, with exceptions for business need, legal retention duties and cases where targeted disposal is not reasonably feasible (16 CFR 314.4(c)(6)(i)). If your map does not say where the copies are, you cannot meet that rule.

For card data the standard asks for the same thing in its own words. PCI DSS v4.0.1 expects accurate data flow diagrams of how account data moves (Requirement 1.2.4) and a documented scope that is confirmed at least every 12 months (Requirement 12.5.2). The PCI Council's PDF could not be retrieved for this lesson, and the two numbers were confirmed in secondary compliance guides, so check them in your own copy of the standard. Lesson 05 covers scoping in detail.

How the risk assessment works

NIST Special Publication 800-30 Rev. 1, Guide for Conducting Risk Assessments (September 2012), is the document most other guidance borrows from. It was written for federal systems and it is free. It says the process has four steps: prepare for the assessment, conduct it, communicate the results, and maintain the assessment over time. Here is each step in plain words.

1. Prepare. Decide the purpose (a board report, a contract requirement, a new system), the scope (the whole company or one business line), the assumptions and the scales you will use to rate likelihood and impact. Skipping this step is why two assessments of the same company disagree.
2. Conduct. Identify threat sources (a criminal group, a careless employee, a failed disk, a flood), the events they could cause (phishing leading to account takeover, ransomware, mistaken email to the wrong customer), the vulnerabilities they would use (no MFA, unpatched server, shared password), and then rate how likely the event is and how bad the impact would be. Risk is the combination of the two.
3. Communicate. Put the results in front of the people who decide, in a form they can act on. A register, a heat map and a one-page memo.
4. Maintain. Keep the results current as systems, vendors and threats change, and watch whether the chosen controls work.

SP 800-30 allows three styles. Qualitative assessment uses words and levels (very low to very high). Semi-quantitative assessment attaches numbers or bins to those words so you can rank. Quantitative assessment uses dollars and probabilities. Its appendices give example five-level scales, from Very Low to Very High, for likelihood and impact, and they say plainly that the organization defines where the break points fall. For a business of this size, a five-level scale with dollar bands tied to your own revenue is the right place to be. Full quantitative modeling needs data most firms of 10 to 500 people do not have, and false precision is a worse failure than a coarse number you can defend.

A scale you can adopt and adjust

The figures below are teaching values. The likelihood bins are adapted from the frequency wording NIST uses in its non-adversarial likelihood scale (for example "occurs less than once a year but more than once every 10 years"). The dollar bins are the author's, sized for a firm with about $30 million to $60 million in annual revenue. Scale the dollar bands to your own: one starting point, the author's suggestion rather than a published rule, is to put the top of the Moderate impact band at about one percent of annual revenue.

Multiply likelihood by impact for a score from 1 to 25. Then group the scores into bands that match the response each band triggers.

The bands are Low (1 to 4), Moderate (5 to 9), High (10 to 15) and Critical (16 to 25). The labels matter less than what each band obliges management to do. A sample appetite statement ties them together.

The risk register

The register is the one document that proves a program exists. It is a table, kept in a spreadsheet or a ticketing system, and it has one row per risk. Here is an excerpt from the invented firm used in the worked example below.

Read the table the way a board member would. Which rows are Critical or High? Who owns them? What date is attached? Did the residual score actually fall, and does the control named in the response explain the drop? A register where every residual score is Low and every owner is "IT" is a sign nobody is thinking about it.

Treat, transfer, accept, avoid

Every risk gets exactly one primary response, though many get a second. Risk management guides use slightly different words for the same four choices. Many business registers say "treat" where others say mitigate or reduce, and that is the word used here.

Avoidance deserves more attention than it gets. A firm that collects a driver's license image for an identity check and keeps it for seven years has created a Restricted data set with no business use after the first week. The cheapest fix is a retention rule and a deletion job. Lesson 13 returns to data minimization.

Residual risk and sign-off

After the response, rate the risk again. That second score is the residual risk. Someone with authority over the budget and the consequences must accept it. The IT provider can advise, and cannot sign for the company. Here is a sample sign-off record, a reference table that fits on one page.

That record is the evidence an auditor, an insurer or a regulator looks for. It shows a decision was made by the right person with the facts in front of them. For the Safeguards Rule, it supports the requirement that the written risk assessment describe how identified risks will be mitigated or accepted (16 CFR 314.4(b)(1)). For the board, it answers the question "who knew?"

CSF 2.0 Organizational Profiles in plain words

The NIST Cybersecurity Framework 2.0, published February 26, 2024, gives a lighter way to do the same thinking at the program level. An Organizational Profile is a snapshot expressed in the framework's outcomes. NIST's Quick-Start Guide (Special Publication 1301, also February 26, 2024) describes two kinds. A Current Profile records the outcomes you are achieving now and to what extent. A Target Profile records the outcomes you have chosen and prioritized, considering new requirements, new technology and trends in threats. A gap analysis compares them and produces an action plan. The guide lays out five steps: scope the Organizational Profile, gather the information needed, create the profile (Current and Target), analyze the gaps and create an action plan, and implement the plan and update the profile as risks change. You may keep as many profiles as you need, each with its own scope, such as one for the office network and one for a plant floor.

How does a profile relate to a risk register? The register works one risk at a time. The profile works one outcome at a time. A good program uses both. The Target Profile says "we intend to have tested restores of every Tier 1 system." The register says "ransomware on the file server is a High risk, and the restore test is the response." One feeds the other, and the profile gives the board a single page that shows progress.

ISO/IEC 27005 in one section

ISO/IEC 27005:2022 (fourth edition, published October 2022) is guidance on managing information security risks. ISO describes it as supporting an information security management system built on ISO/IEC 27001. It is the risk-method companion to the certification standard that lesson 04 covers. You need it if you pursue an ISO 27001 certificate, because that standard requires a defined risk assessment and treatment process and an auditor will ask how you did it. You do not need to buy it to run a sound risk assessment: SP 800-30 is free and covers the same ground. The ISO documents are sold, and the catalogue page is free.

Which laws ask for a written risk assessment

Note what the table does not contain. There is no general federal law that requires every business to run a risk assessment. The requirement arrives through your industry, your data or your contracts. Idaho and other states have their own statutes (lesson 07), and customers write the same requirement into master service agreements.

How often to repeat

The Safeguards Rule says periodically, and the NIST text says maintain. Neither gives a number of months, so the interval is yours to set and defend. A schedule that works for a company of 10 to 500:

Questions and answers

We have 40 employees. Do we really need a written risk assessment?

If you fall under the Safeguards Rule with information on 5,000 or more consumers, or you are a HIPAA covered entity or business associate, the law asks for one in writing. If you do not, you still need a way to answer a customer questionnaire or an insurer's application, and both ask whether you do one. A register of 15 rows kept current beats a long document nobody reads.

Who should own the register?

A named security lead, who may be a part-time role, keeps the document. Each line has a business owner who decides the response. Do not make the IT provider the owner of every line. The provider is a custodian, and owners are the people who lose if the risk lands.

How do we pick the dollar bands for impact?

Start from revenue and cash. One approach, offered as the author's suggestion and not a standard, is to set the Moderate band so that its top equals about one percent of annual revenue, and set Critical at an amount that would force layoffs, covenant trouble or a missed payroll. Ask your finance lead. The numbers in this lesson fit a firm with $30 million to $60 million in revenue and will be wrong for a firm ten times smaller or larger.

Is a qualitative scale good enough?

Yes. NIST SP 800-30 treats qualitative and semi-quantitative approaches as normal. Dollar figures sharpen the top few risks, and the worked example shows how. Do not compute dollars for all 60 lines. Spend the effort where the score is High or Critical.

What counts as "sensitive data" for the data map?

Start with whatever a law or contract names: payment card numbers, Social Security numbers, financial account numbers, health information, biometric data, children's data and credentials. Add anything whose leak would hurt the business, such as bids and source code. The classification table gives the four labels and the handling for each.

We use a lot of SaaS. How do we map data we do not control?

You map the flow into and out of the vendor, and you record what the vendor holds, where it is hosted and how it deletes data when you leave. The vendor's SOC 2 report and contract answer part of that. Lesson 09 covers the questions to ask.

Should the register include privacy risks as well as security risks?

Yes. Collecting data you do not need, keeping it past its use, sharing it with a vendor without a contract and ignoring a consumer request are risks even if no attacker is involved. Tag each line "security", "privacy" or both so the privacy lead can filter the view. Lesson 13 builds the privacy program.

How long does the first pass take?

For a company of 100 people, expect two to four weeks of part-time effort across HR, finance, operations and the IT provider to build the inventory, the data map for the top three data sets and a first register. The second year takes a fraction of that.

Hard questions

"These scores are made up. Why should the board trust a number the team invented?"

The scores are judgments, and the register should say so. The value is in the consistency. Using the same scale each quarter lets the board see whether a risk is moving, and the dollar example forces people to state the assumptions where others can challenge them. NIST SP 800-30 itself frames assessment scales as examples that the organization tailors. If someone disputes a score, change the assumption and rerun the arithmetic in the meeting.

"We cannot afford the time for this. Our people are already stretched."

Then do the narrow version first: the top three data sets, the 20 most important assets and the 10 biggest risks. Skipping the work does not remove the risk, it removes your ability to explain it afterward. The Safeguards Rule and HIPAA Security Rule do not give a size discount on the duty to assess, though the Safeguards Rule exempts some institutions from the written risk assessment at the 5,000 consumer line.

"Insurance covers us, so why spend on controls?"

Insurance transfers part of the money loss, and policies carry limits, sublimits and exclusions, including failure to maintain the controls you described on the application (lesson 12). It does not restore your data, answer regulator questions or return a customer who left. Underwriters now ask for MFA, backup and detection evidence before they quote, so the controls are a condition of the policy.

"If we write down every risk, doesn't that hand a plaintiff or regulator a list of things we knew and did not fix?"

A register shows what you knew, and it also shows what you did. The record that hurts is the one that shows a known High risk with no owner and no date. The record that helps shows a decision by a named person based on cost and likelihood. Mark the register confidential, limit who can edit it, and keep acceptance records current. Your duty to assess and to document comes from statute and contract, so leaving the record blank does not make the duty go away.

"Why not skip the assessment and just implement CIS Controls IG1?"

Implementing a standard set of safeguards is a good start, and lesson 04 recommends it. It still leaves open which of your assets matter most, which vendors hold your Restricted data and which gaps to close first. The assessment ranks the work. It also gives you a documented reason for each exception when the safeguard does not apply to you.