Cyber security risk assessments have gone from a nice-to-have to a near-universal requirement. Insurers ask for them before issuing cover, clients ask for them before signing contracts, and regulators ask for them before letting you touch customer data at all. If you’ve got one booked, the good news is that a bit of preparation goes a long way toward a smooth result.
This guide walks through what to do before the assessors show up, whether you’re running a custom platform, an online store, or a growing website that’s outgrown its original setup.
Start with an honest inventory of what you actually have
You can’t assess the risk of something you don’t know exists. Before anything else, list every system, app, database, and third-party tool your business touches: customer records, payment processing, internal tools, cloud storage, even the spreadsheet someone keeps on their desktop. Shadow IT — tools staff picked up without telling anyone — is one of the biggest blind spots assessors find, so dig a little.
If your business runs on a custom-built platform rather than off-the-shelf software, this step is usually faster because the architecture was documented from day one. It’s one of the quiet advantages of bespoke platform development over cobbling together disconnected tools: you actually know what’s running underneath.
Check who has access to what
Access creep is almost universal. Former employees still have logins. Contractors from two projects ago can still reach the admin panel. Marketing has access to the database for no real reason. Go through every system and strip access back to what people genuinely need today. Assessors will ask for this list, and tidying it beforehand saves a lot of awkward conversations during the review itself.
Patch, update, and retire anything old
Outdated software is the single most common finding in any risk assessment. Check that your platforms, plugins, and store integrations are running current versions. If you’re on an online store, this includes checked-and-updated apps and themes, not just the core platform — a professionally managed Shopify setup keeps this under control as a matter of course rather than as a pre-audit scramble. If you’re carrying an old website built years ago on a stack nobody maintains anymore, it’s worth asking whether a rebuild through modern website design is cheaper long-term than patching something unsupported.
Get your data handling in writing
Assessors don’t just want secure systems — they want proof you know how data flows through your business. Where is customer data stored, who can see it, how long do you keep it, and what happens if it’s compromised? Write this down even if it feels obvious internally. A documented policy, however short, is worth more to an assessor than an undocumented good habit.
What happens during a cyber security risk assessment?
An assessor typically reviews your systems, access controls, and data policies against a recognised standard (often Cyber Essentials or ISO 27001 in the UK). They’ll look for unpatched software, weak passwords, poor access control, missing backups, and gaps in your incident response plan. You’ll usually get a report ranking findings by severity, with a list of fixes required before certification or sign-off. Most assessments take anywhere from a few days to a few weeks depending on the size and complexity of your systems.
Don’t go it alone if your systems are complex
If your business runs on multiple integrated systems — a custom app, a store, internal tools — it’s worth getting technical input before the assessment rather than after a failed one. A short conversation with a development team can flag the obvious gaps early. If you already work with a team on an ongoing basis, a support plan that includes security monitoring makes assessments far less stressful, because the groundwork is already being maintained rather than bolted on in a panic.
For more on keeping systems secure as they grow, our blog covers related topics on platform maintenance and best practice. And if you’d rather talk it through with someone who builds and maintains these systems for a living, get in touch — we’re happy to point out obvious risks even before any formal engagement.
Frequently Asked Questions
How long should I budget to prepare for a risk assessment?
For a small business with a handful of systems, a week or two of focused effort is usually enough. Larger businesses with multiple platforms, stores, or legacy systems should budget four to six weeks to properly inventory, patch, and document everything.
Does my website need to be included in the assessment?
Yes. Any system that collects, stores, or transmits customer data — including contact forms, login areas, and checkout pages — falls within scope. Even a simple brochure site should be checked for outdated plugins or exposed admin areas.
Can a development agency help with the assessment itself?
Most agencies, including us, don’t issue formal certifications, but we can fix the technical findings an assessor identifies — patching, access controls, secure architecture — and build systems that pass future assessments more easily from the outset.