the work
risk assessment
Every rule says appropriate to the risk. Without a written assessment you cannot show that anything you did was appropriate, and you have no honest way to do less.
the reality
This is a working document, and it makes the rest of the site cheaper. It tells you which supplier to check first, which access to review first and what to back up first. It also gives you an honest way to do less: if the risk is low and the reason is written down, a lighter measure can be defensible.
Keep it short and keep it plain enough for the board to read.
basis NIS2 Art. 21(1); GDPR Art. 32(1)
what to decide
- Which services the business cannot run withoutchief executive, with operations
- Who owns each high risk, and by whennamed owner
- Which risks you accept, in writingboard
- What goes to the board and what stays with the teamboard
basis NIS2 Art. 20(1), 21(1); DORA Art. 5(2), 8(1). The split is practice.
a risk grid small enough to use
- note it
- owner and a date
- goes to the board
basis working practice. No legal text sets this.
what to build
- List five to ten services the business cannot run without. For each, name the systems, the data and the suppliers behind it.
- Write what could go wrong in plain words: locked by ransomware, a supplier fails, a leaver keeps access, data sent to the wrong place.
- Score likely and how bad on three points each.
- For each high risk decide: reduce, transfer, avoid or accept. Add an owner and a date.
- Add personal data as its own column, so the same document supports your GDPR reasoning.
- Take the result to the board.
basis NIS2 Art. 21(2)(a); DORA Art. 6(1), 8(1); GDPR Art. 30(1), 32(1); IR 2024/2690 Annex 2.1, 12.4 as a reference
what the risk assessment feeds
- 1your serviceswhat the business cannot run without
- 2what could go wrongin plain words
- 3scorelikely, and how bad
- 4decidereduce, transfer, avoid or accept
the answers set the order of everything else
- supplierswhich to check first
- accesswhich system to review first
- backupswhat to restore first
- the boardwhat they have to decide
basis NIS2 Art. 21(1), 21(2)(a); DORA Art. 6(1), 8(1); GDPR Art. 32(1). The order is practice.
the evidence it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| service and asset list | head of IT | yearly and on major change |
| risk register: risk, score, decision, owner, date | named owner | twice a year |
| signed risk acceptances | board | yearly |
| record of processing activities | DPO or privacy owner | yearly |
basis DORA Art. 8(1); GDPR Art. 30(1). The rest is practice.
what goes wrong
a famous method nobody follows
No text here prescribes one. A short written method you use beats a large one you do not.
two hundred risks
A register that long gets no owners. Twenty with names are worth more.
written once for an audit
It only helps if it sets the order of the work. If nothing changed because of it, it is not doing its job.
only the company's risk
GDPR asks about the risk to people. Add that column, or the document will not answer that question.
basis GDPR Art. 32(1); the rest is practice
what the texts leave open
- Which method. No text here prescribes one.
- How much is proportionate. Regulators and courts decide afterwards, judging concretely against the risks of the processing. Your reasons on paper are what they will see.
basis Court of Justice, C-340/21
check it yourself
what each text says, for whoever checks this page
| text | says |
|---|---|
| NIS2 Art. 21(2)(a) | Policies on risk analysis and information system security. |
| NIS2 Art. 21(1) | Measures appropriate and proportionate to risk, exposure, size, likelihood and severity. |
| IR 2024/2690 Annex 2.1 | Listed digital providers: a risk management framework. Annex 12.4 asks for an asset inventory. |
| DORA Art. 6(1) | A documented ICT risk management framework. |
| DORA Art. 8(1) | Identify and document functions, assets and dependencies, reviewed at least yearly. |
| GDPR Art. 32(1) | Security appropriate to the risk to people. |
| GDPR Art. 30(1) | A record of processing activities. |
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2690 (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
- Court of Justice of the EU, C-340/21, judgment of 14 December 2023
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Book 90 minutes with whoever runs operations and write down your first five services.