Every security assessment produces a list of risks. The challenge is not identifying them, but deciding what to fix first. At Dataeye we start from a simple principle: we separate what is critical from what is just a box to tick. The basic tool is assessing each risk on two axes: likelihood and impact.
Likelihood: how credible is the scenario?
We use a scale from 1 to 5:
- 1 – Rare: an exceptional event, with no relevant indicators;
- 2 – Unlikely: it may occur under certain conditions;
- 3 – Possible: a credible scenario, supported by concrete factors or dependencies;
- 4 – Likely: there are clear signals or insufficient controls;
- 5 – Almost certain: the risk is imminent, recurring or already materialising.
Impact: what happens if the risk materialises?
Impact is also assessed on a scale from 1 to 5, from Very low (a minor effect, with no significant consequences) to Critical (it may lead to business disruption, operational incidents or serious consequences). What matters is not only the technical perspective, but also the effect on the business: service availability, data confidentiality, legal obligations and reputation.
From score to decision
Combining the two scores gives you the exposure level of each risk. A likely risk with critical impact goes to the top of the list; a rare risk with low impact can be monitored or accepted temporarily, in a deliberate and documented way.
To keep decisions fast and predictable, we set tolerances and escalation thresholds from the start. Low or moderate risks are handled at operational level, high risks are analysed in project meetings and critical risks are escalated without delay to the appropriate decision-making level.
Every risk has an owner
A list of risks without owners remains just a list. Every risk in the register has a designated owner, and response actions are assigned and tracked through to completion. Risks are reassessed periodically, because the context changes too: new systems, new vendors or new requirements appear.
The result is a clear action plan: what needs to be fixed, in what order, with what resources and within what timeframe. That is what turning technical information into clear decisions and concrete steps means.
