--- title: What is a Risk Assessment? – Nate Hartman description: Here are some considerations to help you get the most value from your security & privacy risk assessment. image: https://www.truvantis.com/hubfs/Blogs/What%20is%20a%20Risk%20Assessment%20%E2%80%93%20Nate%20Hartman%20.png --- [![truvantis-logo-reverse@2x](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-reverse@2x.png?width=1117&height=250&name=truvantis-logo-reverse@2x.png "truvantis-logo-reverse@2x")](https://www.truvantis.com) [![truvantis-logo-main@2x-1](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-main@2x-1.png?width=1117&height=250&name=truvantis-logo-main@2x-1.png "truvantis-logo-main@2x-1")](https://www.truvantis.com/) ** ## Blog ![](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-main@2x-1.png?length=200) # What is a Risk Assessment? – Nate Hartman October 12, 2023 Risk in general is the likelihood and the possible impact of something bad happening in the near future. A risk assessment is an introspective document that helps the company understand risk and then take risks to move the business forward, in a managed, controlled way.   The output is based on the appropriate risk assessment framework.  It should contain a risk register that describes how the risk was assessed, how it was calculated, the value of the risk and the math of how that risk value was derived. And then it should have a corresponding treatment plan that aligns with each risk item on the risk register in an organization that doesn't have a culture of risk assessment.  | Typically, in enterprise risk management we use a risk assessment matrix visually shown on a 5 x 5 heat map. Risk assessments are the language of how we talk, identify, and talk and quantify risk so that we can have an intelligent conversation about it. You have to have an established risk appetite.  | ![](https://www.truvantis.com/hs-fs/hubfs/undefined-Oct-12-2023-04-59-47-3516-PM.png?width=375&height=188&name=undefined-Oct-12-2023-04-59-47-3516-PM.png) | | --- | --- | *Q: Has much changed on the methodology front?  * With new technology including .ai, we’re starting to get some better tools to help with quantitative risk assessments.  A true quantitative risk assessment should in theory tie the risk value to ROI in U.S. Dollars, against the cost of the mitigating control that you're putting in place.  That's ultimately what the board would like and ultimately the best for business. ---   ![Truvantis - Nate Hartman](https://www.truvantis.com/hs-fs/hubfs/Webinar%20Headshots/Truvantis%20-%20Nate%20Hartman.png?width=140&height=140&name=Truvantis%20-%20Nate%20Hartman.png) Nate S. Hartman CISSP, CCSP, CRISC, CEH, DCHA Nate S. Hartman is CISO and VP of Professional Services at Truvantis. He has over 25 years of focused experience in Cybersecurity and was Director of Risk at Symantec Corporation leading a global team in GRC, Security Risk Management and Internal Security Audits.   ## Listen to the Full Interview   For the full interview please visit The Truvantis Risk Radar [YouTube](https://youtu.be/gyuIdEXbVkI)  channel or listen to the [podcast](https://www.truvantis.com/podcast#The_PCI_Dream_Team:_Part_3_-_Controversial_Topics_with_The_PCI_Dream_Team).  #### Related Articles By Topic [Security Program](https://www.truvantis.com/blog/tag/security-program) [Risk Assessment](https://www.truvantis.com/blog/tag/risk-assessment) ### Subscribe Here! ### Recent Posts ### Related Articles By Topic - [Security Program (76)](https://www.truvantis.com/blog/tag/security-program) - [vCISO (38)](https://www.truvantis.com/blog/tag/vciso) - [CISO (35)](https://www.truvantis.com/blog/tag/ciso) - [PCI DSS (28)](https://www.truvantis.com/blog/tag/pci-dss) - [SOC2 (28)](https://www.truvantis.com/blog/tag/soc2) - [Penetration Testing (27)](https://www.truvantis.com/blog/tag/penetration-testing) - [Privacy (26)](https://www.truvantis.com/blog/tag/privacy) - [Risk Assessment (19)](https://www.truvantis.com/blog/tag/risk-assessment) - [CIS Controls (12)](https://www.truvantis.com/blog/tag/cis-controls) - [Red Teaming (8)](https://www.truvantis.com/blog/tag/red-teaming) - [HIPAA (7)](https://www.truvantis.com/blog/tag/hipaa) - [Threat Intelligence (7)](https://www.truvantis.com/blog/tag/threat-intelligence) - [ISO27001 (6)](https://www.truvantis.com/blog/tag/iso27001) - [CCPA (5)](https://www.truvantis.com/blog/tag/ccpa) - [CPRA (2)](https://www.truvantis.com/blog/tag/cpra) - [GDPR (2)](https://www.truvantis.com/blog/tag/gdpr) - [Ransomware (2)](https://www.truvantis.com/blog/tag/ransomware) - [Red Team (2)](https://www.truvantis.com/blog/tag/red-team) - [HITRUST (1)](https://www.truvantis.com/blog/tag/hitrust) [See all](https://www.truvantis.com/blog/what-is-a-risk-assessment-nate-hartman#) Contact Us Contact Truvantis to schedule a Cybersecurity Workshop [![Schedule a call](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4366475/0b8e00cd-457a-4115-81ca-16a8b3b785a2.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4366475/0b8e00cd-457a-4115-81ca-16a8b3b785a2) [![Contact Us](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4366475/ccf084a3-d095-4418-80d6-891f8fdade46.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4366475/ccf084a3-d095-4418-80d6-891f8fdade46) ### Recent Articles ![Truvantis - Cybersecurity Maturity - One Size Does Not Fit All ](https://www.truvantis.com/hubfs/Blogs/Cybersecurity%20Maturity%20-%20One%20Size%20Does%20Not%20Fit%20All.png) PCI DSS, CIS Controls, Security Program, Privacy, ISO27001 [ Cybersecurity Maturity - One Size Does Not Fit All – Rick Folkerts ](https://www.truvantis.com/blog/cybersecurity-maturity-one-size-does-not-fit-all-rick-folkert) It's common knowledge that enterprise organizations need effective security, privacy and compliance programs to survive and grow. There are a handful of generic best practices but beyond that, cybersecurity programs must be tailored to... [Read more **](https://www.truvantis.com/blog/cybersecurity-maturity-one-size-does-not-fit-all-rick-folkert) ![The Silver Bullet Defense to Ransomware – by Andy Cottrell](https://www.truvantis.com/hubfs/Blogs/The%20Silver%20Bullet%20Defense%20to%20Ransomware%20%E2%80%93%20by%20Andy%20Cottrell.png) Ransomware [ The Silver Bullet Defense to Ransomware – by Andy Cottrell ](https://www.truvantis.com/blog/the-silver-bullet-defense-to-ransomware-by-andy-cottrell) In an era of cost-cutting, downsizing and generally insufficient budgets for everything, we are often asked, what is the one, main thing to do to protect against a ransomware attack? According to Statista, in 2022, there were 493.33 mi... [Read more **](https://www.truvantis.com/blog/the-silver-bullet-defense-to-ransomware-by-andy-cottrell) ![Cryptographic Agility – by Jeff Hall (the ’PCI Guru’)](https://www.truvantis.com/hubfs/Blogs/Cryptographic%20Agility%20%E2%80%93%20by%20Jeff%20Hall%20(the%20%E2%80%99PCI%20Guru%E2%80%99).png) Security Program [ Cryptographic Agility – by Jeff Hall (the ’PCI Guru’) ](https://www.truvantis.com/blog/cryptographic-agility) With the advent of quantum computing, a new threat has been added to the information security mix. The threat is today’s secure cryptography may not be secure once quantum computers reach their potential. The threat to cryptography has... [Read more **](https://www.truvantis.com/blog/cryptographic-agility) [![truvantis-logo-white@2x-1](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-white@2x-1.png?width=1117&height=250&name=truvantis-logo-white@2x-1.png "truvantis-logo-white@2x-1")](https://www.truvantis.com/) [info@truvantis.com](mailto:info@truvantis.com) +1 (415) 422-9844 © 2024 Truvantis, Inc All Rights Reserved. [Privacy Policy](https://www.truvantis.com/privacy-policy)    [Terms of Service ](https://www.truvantis.com/terms-of-service) ![](https://px.ads.linkedin.com/collect/?pid=2614233&fmt=gif) ![](https://ws.zoominfo.com/pixel/dnjpprEKcMtv41HRInFR)