A Security Risk Assessment (SRA) is an assessment that involves identifying risks in your company, technology, and processes to verify that controls are in place to safeguard against security threats.
Why Security Risk Assessments Matter
Security risk assessments are typically required by compliance standards including:
- PCI-DSS
- SOC II audits
- ISO 27001
- HITRUST CSF
- HIPAA compliance
They may also be called risk assessments, IT infrastructure risk assessments, security risk audits, or security audits.
Purpose of an SRA
An SRA is performed by security assessors who evaluate all aspects of company systems to identify risk areas—from weak password policies to insecure business processes. Assessors review IT security policies and firewall configurations while identifying potential risks.
The assessment follows a simple framework:
- Identify critical assets - Such as databases with sensitive information
- Recognize vulnerabilities - Such as internet connectivity exposures
- Implement controls - Such as firewalls to mitigate risk
Why You Need One
An SRA provides a "blueprint of risks" that exist in your environment and clarifies which issues are most critical. This allows organizations to:
- Maximize IT resources and budget
- Prioritize security improvements strategically
- Meet compliance requirements
- Understand their true security posture
Risk Assessment vs. Risk Management
Security Risk Assessment
- A point-in-time review identifying problems and security holes
- Deep dive evaluations that test systems and people
- Ranks findings by risk severity
- Results include specific technical data like network scanning or firewall configuration reports
Risk Management
- An ongoing process collecting known problems and developing solutions
- Continuous effort through regular management meetings
- Identifies, ranks, and discusses risks
- Ensures nothing slips through and security steadily improves
Systems Covered in an SRA
Infrastructure
- Facility power and redundancy
- Backup power, UPS, and generator capacity
- Cooling capacity and redundancy
- Fire suppression systems
- Server wiring and cabling
- Server rack infrastructure
- Physical security and tracking systems
- Camera and alarm systems
Servers and Systems
- Server inventory and operating systems
- Vulnerability reports
- Resource utilization
- Backup processes
- Redundancy and high availability configuration
- Anti-virus/anti-malware systems
- IT asset inventory processes
- Update processes
- Identity and authentication systems
Network
- Network discovery mapping
- Network inventory lists
- Internal and external vulnerability scans
- Firewall vulnerability scans
- IDS/IPS review
- Spam filtering review
- Web filter device review
- Data loss prevention systems review
Application Scanning
- Discovery of internal and external web applications
- Application vulnerability assessments
- Application server vulnerability scanning
Information Security
- Sensitive data inventory
- Data classification
- Data risk analysis
- Data encryption review
- Access authorization procedures and controls
Policies
- Comprehensive IT policy review
- Disaster recovery plan review
- Business continuity plan review
- Device and media control policy review
- Software development procedure review
- Security incident procedure review
- Log monitoring process review
- Workforce security policy review
- Workforce hiring/termination policy review
- Risk management process review
How Security Risk Assessments Are Performed
SRAs typically cover all company aspects (IT, operations, HR, accounting) over 30-60+ days and include these phases:
Phase 1: Initial Discussion
Scheduling a conference call to discuss the company, procedures, and assessment goals.
Phase 2: Onsite Discovery
Expert team conducts onsite reviews of technology and processes.
Phase 3: Analysis
Analysts identify risks and existing controls from gathered information.
Phase 4: The Report
A comprehensive Risk Assessment report outlines all assets, vulnerabilities, and risks with recommendations for improving overall security and compliance.
Key Takeaways
- An SRA identifies risks across your company, technology, and processes
- Required by many compliance frameworks including PCI-DSS, SOC II, ISO 27001, HITRUST, and HIPAA
- Provides a blueprint of risks and helps prioritize security improvements
- Covers infrastructure, servers, network, applications, information security, and policies
- Typically takes 30-60+ days and includes discovery, analysis, and reporting phases
- Different from ongoing risk management, which is a continuous process