Operational
Risk Assessment

We'll send your summary here. If you return to update your answers, we'll match on this address.

Optional — helps us identify any publicly visible risks on your domain.

Include full-time, part-time, and regular contractors.

Banded — no exact figure needed. Helps us give financial risk exposure context.

This includes anything from a brief induction session to formal annual training.

MFA — also called two-step verification or 2FA — means staff need a second check (like a code on their phone) in addition to their password to log in.

A password manager is an app (like Bitwarden, 1Password, or the one built into your browser) that stores and fills your passwords securely.

For example: calling a supplier on a known number to confirm a change of bank details before making a payment. This type of fraud — Business Email Compromise — is among the most costly attacks on UK SMEs.

Include all PCs, laptops, and Macs used for work — including personal devices used to access business email or systems.

For example: smart TVs, IP cameras, door access systems, printers, smart speakers, or industrial control equipment connected to the internet or your network.

This includes Windows or macOS updates, and updates to apps like Office, browsers, and any software your business relies on.

This includes standard antivirus (like Windows Defender, Norton, or McAfee) and more advanced tools sometimes called EDR — endpoint detection and response.

Unlicensed software is often a source of malware and doesn't receive security updates — making it a common entry point for attackers.

Routers, printers, cameras, and other devices often ship with a default admin password like "admin" or "1234". These should be changed before use and are a Cyber Essentials requirement.

A guest Wi-Fi gives visitors internet access without letting them reach your internal files, servers, or connected devices. Mixing the two on a single network is a common and easily exploited gap.

This includes accessing email, files, internal systems, or any business application from outside the office.

Public Wi-Fi is frequently unencrypted and can be monitored by others on the same network. A VPN or mobile data connection provides significantly better protection when working outside the office.

Backups stored only on the same device or network as your main data won't protect you from ransomware. Offsite or cloud copies are important. Select all that apply.

This doesn't need to be formal — even a short document covering who to call and what steps to take counts.

Cloud means the software runs over the internet rather than on your own computers. Select all that apply.

Personal data includes names, email addresses, phone numbers, financial details, health information, or anything else that could identify a living person. Most businesses handle at least some.

This includes phishing attacks, ransomware, data breaches, fraud, or any security event — even if it was caught early or didn't cause significant disruption.

For example: a local IT support company, an MSP, or a freelance IT consultant you use regularly.