Risk Assessment Using NIST CSF 2.0

Build a professional risk register and controls map for a fictional accounting firm.

Introduction

30 Second Summary

Every business stores data it cannot afford to lose. When something goes wrong, leadership wants to know who identified the risk, what's being done about it, and why nobody flagged it sooner.

In this project, you will step into the role of a GRC Analyst conducting a full cybersecurity risk assessment for a fictional accounting firm using the NIST Cybersecurity Framework 2.0.

What You'll Build

You'll hand your client a complete risk assessment package: a scored risk register, a controls gap analysis, and a one-page executive summary that a board member can read and act on in a single sitting.

By the end of this project, you'll have:

A professional asset inventory and scored risk register with 10+ cybersecurity risks ranked using the industry-standard 5x5 risk scoring matrix, ready to walk an interviewer through.
A controls mapping across all six NIST CSF 2.0 functions that exposes exactly where the firm's security program has dangerous gaps.
A one-page executive summary that translates your technical findings into prioritized recommendations leadership can act on.
Secret Mission: Develop a Plan of Action and Milestones (POA&M) with risk treatment recommendations for the top critical and high risks.

Are there any prerequisites?

This project assumes a basic understanding of cybersecurity frameworks (the kind covered in a Cybersecurity Management degree or Security+ study). You should also be comfortable working in Google Sheets.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters.

Set Up Your GRC Workspace

A professional risk assessment needs structure before analysis begins. Without organized templates, findings end up scattered across random files and lose their impact when you present them to a hiring manager or a client.

In this step, you'll create a structured Google Sheets workbook and a Google Doc that together form your GRC workspace. Every deliverable you produce from here will be organized, shareable, and portfolio-ready.

In this step, get ready to:

Create a Google Sheets workbook with three purpose-built tabs and column headers.
Create an executive summary document template in Google Docs.
Add a 5x5 scoring reference table to your Risk Register tab.

Create your risk assessment workbook

Your workbook will hold three tabs, each serving a distinct purpose in the assessment. The Asset Inventory records what you are protecting. The Risk Register captures threats and scores them. The Controls Mapping reveals where security gaps exist.

Open your browser and go to sheets.google.com.
Click Blank spreadsheet to create a new workbook.
Click the title in the top-left corner (it says Untitled spreadsheet) and rename it to Greenfield & Associates - Risk Assessment.

Now set up the three tabs. Your workbook starts with one tab called Sheet1 at the bottom of the screen.

Double-click the Sheet1 tab at the bottom and rename it to Asset Inventory.
Click the + icon to the left of your tab to add a new tab.
Double-click the new tab and rename it to Risk Register.
Click the + icon again to add a third tab.
Double-click it and rename it to Controls Mapping.

You should now see three tabs at the bottom of your workbook: Asset Inventory, Risk Register, and Controls Mapping.

Don't see three tabs?

Make sure you renamed the original Sheet1 tab rather than creating a fourth one. If you have an extra tab, right-click it and select Delete.

If you accidentally deleted a tab, click the + icon to add a new one and rename it.

Now add column headers to each tab. These headers define the data you will capture during the assessment.

Click the Asset Inventory tab.
In row 1, type the following headers across columns A through F: Asset ID, Asset Name, Category, Description, Data Classification, Owner.

Click the Risk Register tab.
In row 1, type the following headers across columns A through K: Risk ID, Asset, Threat Source, Threat Event, Vulnerability, Business Impact, Likelihood, Impact, Risk Score, Risk Level, CSF Function.

Click the Controls Mapping tab.
In row 1, type the following headers across columns A through G: Function, Category ID, Category Name, Implementation Status, Current Control, Gap Description, Related Risk IDs.

Bold your header rows

Select the entire first row in each tab, then press Ctrl+B to bold the headers. This makes your workbook look more professional and easier to scan.

Click through each of your three tabs. You should see the column headers populated in row 1 of each tab.

Create the executive summary document

The executive summary is the document your client's leadership team will actually read. Setting up placeholder sections now gives you a clear structure to fill in once your analysis is complete.

Open a new browser tab and go to docs.google.com.
Click Blank document to create a new doc.
Click the title in the top-left corner and rename it to Greenfield & Associates - Executive Summary.

Now add four section headings that will structure your final deliverable.

Type Assessment Overview and format it as Heading 2 using the styles dropdown in the toolbar.
Press Enter twice, then type Key Findings and format it as Heading 2.
Press Enter twice, then type Risk Heat Map Summary and format it as Heading 2.
Press Enter twice, then type Recommendations and format it as Heading 2.

Your Google Doc should now show four clearly separated section headings. You will fill these in during Step 5.

Why set this up now?

Creating the structure first means you can focus entirely on analysis in later steps. You will not need to stop and think about formatting when you are writing findings for leadership.

Add the 5x5 scoring reference to the Risk Register

The 5x5 risk scoring matrix is the industry-standard method for qualitative risk scoring. You'll reference this table constantly when scoring risks in Step 3, so embedding it directly in the tab saves you from flipping between documents.

Switch back to your Google Sheets workbook.
Click the Risk Register tab.
In cell M1, type Scoring Reference and bold it.
In cell M2, type Risk Score = Likelihood x Impact.

Below that, add the severity scale so you can quickly classify each score.

In cell M3, type 1-4 = Low.
In cell M4, type 5-9 = Moderate.
In cell M5, type 10-14 = High.
In cell M6, type 15-25 = Critical.

What is the 5x5 risk scoring matrix?

You rate each risk on two axes: Likelihood (1 = Rare through 5 = Almost Certain) and Impact (1 = Negligible through 5 = Catastrophic). Multiplying them gives a score between 1 and 25.

The severity bands (Low, Moderate, High, Critical) let you quickly communicate priority to stakeholders without requiring them to interpret raw numbers.

Color-code your severity scale

Highlight cell M3 in green, M4 in yellow, M5 in orange, and M6 in red. This visual reference will match the conditional formatting you apply to risk scores in Step 3.

Your Risk Register tab should now show column headers in row 1 and a scoring reference block starting in column M.

Scoring reference overlapping your headers?

Make sure you placed the reference starting in column M, which is two columns past your last header column (K). If it overlaps, select the reference cells, cut them with Ctrl+X, click cell M1, and paste with Ctrl+V.

Help me fix my Risk Register layout.

Confirm your workspace is ready

Before moving on, take a moment to review everything you just built. Can you confirm the following?

Click through all three tabs in your Google Sheets workbook: Asset Inventory, Risk Register, and Controls Mapping.
Verify each tab has its column headers populated in row 1.
Confirm the scoring reference appears in column M of the Risk Register tab.
Switch to your Google Doc and confirm four section headings are visible: Assessment Overview, Key Findings, Risk Heat Map Summary, and Recommendations.

Your GRC workspace is ready. Next up, you'll profile Greenfield & Associates and build the asset inventory that anchors every risk you identify.

Profile the Company and Build the Asset Inventory

Your GRC workspace is structured and ready. The tabs have headers, your scoring reference is in place, and your executive summary template is waiting. Now comes the foundational question: what exactly are you protecting?

You cannot assess risk without knowing what you are protecting. The asset inventory is the foundation of every risk assessment because threats target specific assets, not abstract ideas. In this step, you will profile Greenfield & Associates and document every system, data store, and person that an attacker could target.

In this step, get ready to:

Document the company profile and business context.
Identify and record 8-10 critical assets across hardware, software, data, and people categories.
Verify every asset has all six fields populated.

Document the company profile

Before listing individual assets, you need to capture the big picture of your client. A company profile gives every risk you identify later a business context. It answers the question: what kind of organization is this, and what data do they handle?

Switch to your Google Sheets workbook and click the Asset Inventory tab.
In cell A1, type the company profile header below. You can merge cells A1 through F1 first by selecting the range, then clicking Format and selecting Merge cells.

Company Profile: Greenfield & Associates | 50-person accounting firm | Handles client tax returns, financial statements, and payroll data | Uses cloud-based accounting software | On-premises file server for document storage | Allows remote work via VPN

Why start with a company profile?

The profile anchors your entire assessment. When you identify a risk like "unencrypted client data," anyone reading your register can immediately understand the severity by referencing the profile: this firm handles restricted financial records for clients.

It also establishes regulatory context. An accounting firm handling taxpayer data falls under the FTC Safeguards Rule and IRS Publication 4557, which makes certain risks carry legal weight beyond just business disruption.

Confirm you can see the company profile text in row 1 of your Asset Inventory tab.

Identify and document critical assets

Now you will identify every asset that matters to this firm. An asset is anything of value that a threat could target. This includes physical hardware, the software services the firm depends on, the sensitive data those systems hold, and the people who have privileged access.

What is data classification?

Each asset gets a data classification label that reflects how sensitive it is. The four levels are:

Public - information freely available (e.g., the firm's website).
Internal - not secret, but not for public eyes (e.g., internal policies).
Confidential - sensitive business data requiring access controls (e.g., employee PII).
Restricted - highest sensitivity, regulated data with legal consequences if breached (e.g., client tax records).

Starting in row 2 (directly below the header row with your column names), enter the following hardware and software/services assets. Each column maps to your existing headers: Asset ID, Asset Name, Category, Description, Data Classification, Owner.

A-001 | Employee Workstations   | Hardware          | Desktop and laptop computers used by staff for daily work       | Internal     | IT Contractor
A-002 | On-Premises File Server  | Hardware          | Local server storing shared documents and client files          | Confidential | IT Contractor
A-003 | Network Firewall         | Hardware          | Perimeter firewall controlling inbound and outbound traffic     | Internal     | IT Contractor
A-004 | Cloud Accounting Platform| Software/Services | Cloud-based software for managing client accounts and filings   | Confidential | Finance Director
A-005 | Email Service            | Software/Services | Business email used for client and internal communication       | Confidential | IT Contractor
A-006 | Remote Access VPN        | Software/Services | VPN gateway enabling remote employees to access internal systems| Internal     | IT Contractor

What do these entries represent?

The hardware assets (A-001 through A-003) are the physical systems the firm depends on. Workstations are where accountants access client data daily. The file server stores documents locally. The firewall is the firm's first line of defense.

The software/services assets (A-004 through A-006) are the platforms that process and transmit data. Notice the cloud accounting platform is classified as Confidential because it holds client financial records. The VPN is Internal because it is a transport mechanism, not a data store itself.

Count the rows you have entered so far. You should see six rows of data (A-001 through A-006) below your column headers.
Now enter the data and people assets below your last row:

A-007 | Client Tax Records       | Data   | Federal and state tax returns for all clients                   | Restricted   | Finance Director
A-008 | Financial Statements     | Data   | Client balance sheets, income statements, and cash flow reports | Restricted   | Finance Director
A-009 | Payroll Data             | Data   | Employee salary, benefits, and banking information              | Restricted   | HR Manager
A-010 | Employee PII             | Data   | Employee names, SSNs, addresses, and emergency contacts         | Confidential | HR Manager
A-011 | Accountants (Admin)      | People | Staff accountants with admin-level access to accounting platform| Confidential | Finance Director
A-012 | IT Contractor            | People | External contractor managing all IT systems and access controls | Confidential | Managing Partner

Why include people as assets?

People with privileged access are assets because they represent both value and risk. An accountant with admin access can create, modify, or delete financial records. The IT contractor holds the keys to every system. If either account is compromised, the damage is amplified far beyond a standard user breach.

Notice that data assets like client tax records and payroll data are classified as Restricted. A breach of this data triggers regulatory reporting obligations and potential legal action. This classification drives how seriously you will score related risks in Step 3.

Confirm you now have 12 rows of asset data (A-001 through A-012) in your Asset Inventory tab.

Rows not lining up with your headers?

Make sure each piece of data is in its own cell. The pipe characters (|) in the reference above separate columns. Each value between the pipes goes into the next column in your row.

If your company profile in row 1 pushed the column headers down, move the profile to a merged cell above the headers or into a separate row that does not interfere with the data table.

help me fix my Asset Inventory layout in Google Sheets

Review and verify the completed inventory

Your inventory is the attack surface of Greenfield & Associates. Every risk you identify in the next step will be anchored to a specific asset from this list. A missing field now means an incomplete risk entry later.

Scroll through each row and confirm that every cell is filled. No asset should have a blank Data Classification or a missing Owner.
Check that your Data Classification values are consistent. Use exactly one of these four values: Public, Internal, Confidential, or Restricted.
Verify you have assets in all four categories: Hardware, Software/Services, Data, and People.

Before you count your final tally, predict: how many total asset entries should your inventory contain?

You should see 12 entries (A-001 through A-012) covering 3 hardware assets, 3 software/services assets, 4 data assets, and 2 people assets. Each one has all six columns populated with no blanks.

✔️ Awesome, I've got everything!

Great. Your asset inventory is complete. Every risk you identify next will trace back to one of these 12 entries.

ⓧ I'd like to double check the full inventory

Here is the complete asset list for reference. Scroll through your tab and confirm each row matches:

Row 1: Company Profile header (merged cells with firm description).
Row 2: Column headers (Asset ID, Asset Name, Category, Description, Data Classification, Owner).
Rows 3-8: Hardware assets (A-001 through A-003) and Software/Services assets (A-004 through A-006).
Rows 9-14: Data assets (A-007 through A-010) and People assets (A-011, A-012).
Every cell is populated. No blanks in any column.

Your asset inventory now documents exactly what Greenfield & Associates needs to protect. In the next step, you will ask the critical follow-up question for each asset: what could go wrong? You will identify threats, score them using the 5x5 matrix, and build a prioritized risk register.

Identify Threats and Build the Risk Register

Your asset inventory maps out everything Greenfield & Associates depends on. But a list of assets alone does not tell the firm where danger lies or how to spend its security budget.

A risk register transforms vague security concerns into structured, scorable entries that drive decisions. In this step, you will identify realistic threats against each asset, score them using the 5x5 likelihood-impact matrix, and tag each with a NIST CSF 2.0 function.

In this step, get ready to:

Identify 10+ threats using the cause-event-impact format.
Score each risk with the 5x5 likelihood-impact matrix and auto-calculate risk scores.
Tag each risk with a CSF 2.0 function and sort by severity.

Identify threats and vulnerabilities for each asset

Every risk in a professional risk register follows a structured format that connects a weakness to a real-world consequence. This is called the cause-event-impact format.

What is the cause-event-impact format?

Each risk statement follows this template: "Because of [vulnerability], [threat event] could occur, resulting in [impact]." This structure forces you to connect every risk to a specific weakness and a concrete business consequence.

This format comes from NIST SP 800-30 risk assessment methodology. It ensures your risks are actionable, not vague.

Switch to the Risk Register tab in your Google Sheets workbook.
In the first empty row below the headers, start entering risks. For each risk, fill in: Risk ID, Asset, Threat Source, Threat Event, Vulnerability, and Business Impact.
Use sequential Risk IDs starting from R-001.

Here are example risks to get you started. Use these as your first entries, then identify additional risks to reach 10+ total.

Example risk entries for Greenfield & Associates

R-001: Asset: On-premises file server (A-002). Threat Source: External attacker. Threat Event: Stolen or decommissioned hard drive exposes client data. Vulnerability: File server lacks encryption at rest. Business Impact: Regulatory fines under FTC Safeguards Rule, client lawsuits, reputational damage.
R-002: Asset: Accountants with admin access (A-011). Threat Source: External attacker via phishing. Threat Event: Credential theft through spear-phishing email. Vulnerability: No security awareness training program. Business Impact: Unauthorized access to all client financial records, potential data exfiltration.
R-003: Asset: Remote access VPN (A-006). Threat Source: External attacker. Threat Event: Exploitation of unpatched VPN vulnerability. Vulnerability: VPN software not on a regular patching schedule. Business Impact: Network intrusion, lateral movement to file server and accounting platform.
R-004: Asset: Cloud accounting platform (A-004). Threat Source: Insider threat or compromised credentials. Threat Event: Unauthorized modification of client financial statements. Vulnerability: No multi-factor authentication enforced. Business Impact: Financial fraud, audit failures, loss of client trust.

Continue identifying risks until you have at least 10 entries. Think about threats across all your asset categories: hardware, software/services, data stores, and people.

Cover multiple threat types

A strong risk register includes variety. Consider external attackers, insider threats, accidental data loss, natural disasters, and third-party vendor failures. Each asset from your inventory can have multiple risks associated with it.

Review your Risk Register tab. You should see 10+ rows populated with risk entries, each referencing a specific asset from your inventory.

Struggling to reach 10 risks?

Go back to your Asset Inventory and look at each asset one by one. Ask: what could an attacker do to this? What if an employee makes a mistake with this? What if this service goes down? Each question usually reveals at least one risk.

Consider risks like: no backup for the file server (data loss), email service without spam filtering (malware delivery), IT contractor as single point of failure (key person risk), or payroll data accessible over unencrypted channels.

Help me brainstorm more risks for a small accounting firm

Score each risk using the 5x5 matrix

A risk without a score is just an opinion. The 5x5 matrix turns your identified threats into quantifiable, comparable entries by multiplying two factors: how likely is this to happen, and how bad would it be if it did.

For each risk entry, assign a Likelihood score in column G using this scale: 1=Rare, 2=Unlikely, 3=Possible, 4=Likely, 5=Almost Certain.
For each risk entry, assign an Impact score in column H using this scale: 1=Negligible, 2=Minor, 3=Moderate, 4=Major, 5=Catastrophic.

How do I decide the right scores?

Think about Greenfield's context. A phishing attack targeting accountants at a firm with no security training is Likely (4), not Rare. The impact of exposed client tax records is Major (4) or Catastrophic (5) because of regulatory consequences.

A natural disaster destroying the on-premises server might be Rare (1) or Unlikely (2) depending on location, but its impact could still be Catastrophic (5) if there are no backups.

In column I (Risk Score), enter a formula to auto-calculate the score. Click cell I2 and type the following formula:

=G2*H2

Press Enter to confirm the formula.
Copy cell I2 and paste it down column I for all your risk rows.

What does this formula do?

The formula multiplies Likelihood (column G) by Impact (column H) to produce a Risk Score between 1 and 25. This is the standard qualitative risk scoring method from NIST SP 800-30.

Now assign a Risk Level label based on each score. This makes it easy to spot the most dangerous risks at a glance.

In column J (Risk Level), click cell J2 and enter this formula to auto-assign the level:

=IFS(I2>=15,"Critical",I2>=10,"High",I2>=5,"Moderate",I2>=1,"Low")

Press Enter, then copy cell J2 and paste it down column J for all your risk rows.

What does this formula do?

The IFS function checks the Risk Score against the severity ranges: 15-25 is Critical, 10-14 is High, 5-9 is Moderate, and 1-4 is Low. It returns the matching label automatically so you do not have to type each one manually.

Verify your formulas are working. You should see a calculated number in column I and a label (Critical, High, Moderate, or Low) in column J for every risk row.

Now add color coding to make severity levels instantly visible.

Select all cells in column J that contain Risk Level labels.
Click Format in the top menu bar.
Click Conditional formatting.
Add four rules, one for each level. Set Format cells if to Text is exactly:

Critical with a red background.
High with an orange background.
Moderate with a yellow background.
Low with a green background.

Click Done after adding all four rules.

Your Risk Level column should now display colors. Red cells jump out immediately, telling you where the firm's biggest exposures are.

Not seeing colors on your Risk Level cells?

Make sure the range in your conditional formatting rule covers all Risk Level cells (e.g., J2 through J12 or however many rows you have). Also check that the text comparison is set to "Text is exactly" and matches the exact case of your formula output ("Critical", not "critical").

Help me fix my conditional formatting in Google Sheets

Tag risks with CSF functions and sort by severity

Each risk in your register relates to a specific area of cybersecurity governance. Tagging with a CSF function links your findings to the framework, making the register useful for the controls mapping you will build next.

In column K (CSF Function), tag each risk with the primary NIST CSF 2.0 function it relates to. Your options are: Govern, Identify, Protect, Detect, Respond, or Recover.

How do I pick the right CSF function?

Ask: what kind of control would prevent or address this risk? If the fix is access control, encryption, or training, it maps to Protect. If the fix is monitoring or alerting, it maps to Detect. If the risk exists because there is no incident response plan, it maps to Respond.

Govern - risks related to missing policies, oversight, or supply chain governance.
Identify - risks from poor asset visibility or missing risk management processes.
Protect - risks preventable by access controls, encryption, training, or patching.
Detect - risks that persist because threats go unnoticed (no monitoring, no alerting).
Respond - risks worsened by having no incident response or communication plan.
Recover - risks related to inability to restore operations after an incident.

After tagging all risks, sort the entire register by Risk Score descending so the most critical risks appear at the top.
Select all your data rows (not the header row).
Click Data in the top menu bar.
Click Sort range, then select Advanced range sorting options.
Check Data has header row if you included headers in your selection.
Set the sort column to Risk Score (column I) and select Z → A for descending order.
Click Sort.

Before you review the result, predict: how many of your risks scored as Critical (15-25)?

Look at your sorted register. Your Critical and High risks (red and orange cells) should now sit at the top, with Moderate and Low risks below them. You should be able to instantly identify which risks demand the most urgent attention.

Risks not sorting correctly?

If your Risk Score column shows text instead of numbers, Google Sheets may be treating the formula output as text. Click a Risk Score cell, check the formula bar shows =G2*H2, and make sure columns G and H contain numbers (not text-formatted numbers). You can select the columns and set Format > Number > Number to fix this.

Help me fix my Risk Score sorting in Google Sheets

You now have a prioritized risk register with 10+ scored threats. You can tell the firm exactly which risks are most severe. But here is the gap: you can rank individual risks, yet you cannot tell leadership which areas of the security program are systematically weak. Is it detection? Protection? Response? The next step solves this by mapping your findings to every CSF category.

Map Controls to NIST CSF 2.0 and Identify Gaps

Your risk register now tells you which individual risks score highest. But look at it from a leadership perspective. Can you point to which areas of the firm's security program are systematically weak? A flat list of ranked risks does not reveal that pattern.

In this step, you will map Greenfield & Associates' current controls to all 22 categories of the NIST CSF 2.0. This exposes the gaps at a structural level, showing leadership exactly where the program has dangerous holes rather than just a list of individual problems.

In this step, get ready to:

List all six CSF 2.0 functions and their 22 categories in the Controls Mapping tab.
Assess each category's implementation status based on the company profile.
Cross-reference gaps to your Risk Register and identify the weakest function.

Populate the CSF 2.0 framework structure

The Controls Mapping tab already has your column headers from Step 1. Now you need to fill in all 22 category rows that make up the NIST Cybersecurity Framework 2.0 structure. Each row represents one category that the framework says an organization should address.

Switch to the Controls Mapping tab in your Google Sheets workbook.
Starting in row 2, enter the six Govern categories. In each row, fill in the Function column as Govern, then the Category ID and Category Name as listed below:

Continue with the three Identify categories:

Add the five Protect categories:

Verify that you now have 14 rows filled (6 Govern + 3 Identify + 5 Protect). Each row should have the Function, Category ID, and Category Name columns populated.

Add the two Detect categories:
Add the four Respond categories:
Add the two Recover categories:

Your Controls Mapping tab should now have exactly 22 data rows (plus the header row). Count them to confirm: 6 + 3 + 5 + 2 + 4 + 2 = 22.

Why 22 categories?

NIST CSF 2.0 organizes cybersecurity outcomes into 6 Functions and 22 Categories. The Functions tell you the broad area (Govern, Identify, Protect, Detect, Respond, Recover). The Categories break each function into specific outcome areas that an organization should address.

By listing every category, you create a complete picture. Gaps become impossible to hide because every row demands an honest answer about what the organization actually does today.

Don't see 22 rows?

Double-check that you included all six Govern categories. A common mistake is forgetting GV.OV (Oversight), which was added in CSF 2.0. If you are referencing older CSF 1.1 materials, they will not include the Govern function at all.

Help me verify I have all 22 CSF 2.0 categories listed correctly.

Assess implementation status for each category

Now comes the analyst judgment. For each of the 22 categories, you need to determine what Greenfield & Associates actually has in place today. Think back to the company profile: a 50-person accounting firm with one IT contractor, basic antivirus, password policies, cloud backups, and remote work via VPN.

For each row, fill in the Implementation Status column with one of three values: Implemented, Partial, or Not Implemented.
For categories with any control in place, fill in the Current Control column describing what exists.
For categories that are Partial or Not Implemented, fill in the Gap Description column explaining what is missing.

How do I decide the status?

Use these three criteria based on the company profile you documented earlier:

Implemented - A formal, documented control exists and is actively managed. For a 50-person firm with one IT contractor, very few categories will be fully implemented.
Partial - Something exists but it is informal, inconsistent, or incomplete. This is where most of the firm's existing efforts will land.
Not Implemented - No control, process, or capability exists for this category. These are your critical gaps.

Here is the realistic assessment for a firm of this size and maturity. Use these as your guide:

Mark PR.PS (Platform Security) as Partial. Current Control: "Basic antivirus installed on workstations." Gap: "No centralized endpoint management, no patch management process."
Mark PR.AA (Identity Management, Authentication, and Access Control) as Partial. Current Control: "Password policies enforced on cloud accounting platform." Gap: "No multi-factor authentication, no centralized identity provider."
Mark RC.RP (Incident Recovery Plan Execution) as Partial. Current Control: "Cloud backups configured for accounting platform." Gap: "No formal recovery plan, no tested restore procedures, on-premises file server not backed up."

Mark these categories as Not Implemented (fill in the Gap Description for each):
Complete the remaining categories using your judgment. Most Govern and Identify categories will be Not Implemented or Partial for a firm this size. Document a brief justification in the Gap Description for each.

Review your tab. Every row should now have an Implementation Status. Categories marked Partial or Not Implemented should also have a Gap Description explaining what is missing.

Color-code your statuses

Select your Implementation Status cells and apply conditional formatting or manual highlighting: green for Implemented, yellow for Partial, red for Not Implemented. This makes the gaps jump off the page when you share the workbook.

Link gaps to the Risk Register and identify the weakest function

Your Controls Mapping now shows where the firm's defenses are missing. The final piece is connecting these gaps back to the specific risks they cause. This cross-reference proves that the risks in your register are not random. They are direct consequences of missing controls.

For each row in the Controls Mapping tab, fill in the Related Risk IDs column with the Risk IDs from your Risk Register that are caused by or worsened by this gap.
Switch to the Risk Register tab to cross-reference. Look at the CSF Function column you added in Step 3. Risks tagged with Protect relate to Protect category gaps. Risks tagged with Detect relate to Detect category gaps.
Enter the matching Risk IDs (e.g., R-001, R-005) in the Related Risk IDs column for each category that has a gap.

What if a risk maps to multiple categories?

A single risk can appear in multiple category rows. For example, a phishing risk might relate to both PR.AT (no training) and DE.CM (no monitoring to detect the phish). List the Risk ID in every relevant category. This is expected and shows how interconnected security gaps can be.

Now count the gaps per function. For each of the six functions, tally how many categories are marked Not Implemented or Partial. You can add a quick summary below your data rows or in a note.
Identify which function has the most gaps. For a firm like Greenfield & Associates, you will likely find that Detect (2 categories, both likely unaddressed) or Respond (4 categories, mostly unaddressed) is the weakest area.

Before you look at your totals, predict: which CSF function do you think has the largest proportion of unaddressed categories? Think about what a small firm with one IT contractor is least likely to have invested in.

Review your gap counts now. The function with the highest proportion of Not Implemented categories is your headline finding. This is the pattern that a flat risk list could never reveal. It tells leadership exactly where their security program needs the most investment.

Why does the pattern matter more than individual risks?

Telling a board "you have 10 risks" is not actionable. Telling them "your entire Detect capability is missing, which means threats can persist unnoticed for months" drives a specific budget decision. The controls mapping transforms your risk register from a list of problems into a strategic argument.

Related Risk IDs column feels empty for some rows?

Some categories (like GV.OV or GV.PO) may not have a direct risk in your register. That is fine. It means you did not identify a specific threat for that gap, but the gap still exists as a governance weakness. Leave the Related Risk IDs blank for those rows.

Help me figure out which risks map to which CSF categories.

Open your Controls Mapping tab and confirm: you have all 22 category rows with an Implementation Status, at least two categories marked Not Implemented that represent critical gaps, and Related Risk IDs cross-referencing your Risk Register.

You now have a controls mapping that reveals the structural weaknesses in Greenfield & Associates' security posture. Next up, you will translate all of this analysis into a one-page executive summary that a board member can read in five minutes and act on immediately.

Write the Executive Summary

Your risk register is scored and your controls mapping reveals systemic gaps across Greenfield & Associates' security posture. Now you need to translate those technical findings into something a boardroom can act on.

Leadership will never read a spreadsheet with 22 rows of CSF categories. A GRC Analyst's real job is to distill complexity into clear, actionable language. This one-page executive summary is what the board actually reads.

In this step, get ready to:

Write the Assessment Overview with scope and methodology.
Summarize key findings including risk severity breakdown and the weakest CSF function.
Provide 3-5 prioritized recommendations tied to specific gaps.

Complete the Assessment Overview section

The Assessment Overview sets the context for everything that follows. A reader who skips every other section will still know what was assessed, how, and when.

Switch to your Google Doc titled Greenfield & Associates - Executive Summary.
Click into the Assessment Overview placeholder section.
Write 3-4 sentences that state: who requested the assessment (Greenfield & Associates leadership), the scope (all IT assets and data at Greenfield & Associates), the methodology (NIST CSF 2.0 with 5x5 qualitative risk scoring), and today's date.

What belongs in the Assessment Overview?

Think of this section as the contract between you and the reader. It answers four questions: Who asked for this? What did you look at? How did you measure risk? When was it done?

Keep it factual and brief. No findings or recommendations belong here.

After writing your 3-4 sentences, read them back. You should be able to hand this paragraph to a stranger and they would know exactly what assessment was performed without reading anything else.

Summarize key findings and risk severity

The Key Findings section is where leadership learns how much trouble they are in. Your job is to present the data clearly enough that a non-technical reader grasps the urgency.

Click into the Key Findings placeholder section of your Google Doc.
Return to your Risk Register tab in Google Sheets and count how many risks fall into each severity level (Critical, High, Moderate, Low).
In the Key Findings section, write the total risk count by severity level (for example: 2 Critical, 4 High, 3 Moderate, 2 Low).
Name your top 3 risks by score, including the asset they affect and the threat event.
State which CSF function has the most gaps from your Controls Mapping tab. Frame it as a headline finding (for example: "The firm's Detect capability is the weakest area, with 0 of 2 categories implemented").
Add a sentence noting the regulatory context: client financial data is subject to the FTC Safeguards Rule (16 CFR Part 314) and IRS Publication 4557 (Safeguarding Taxpayer Data).

Why mention regulatory context?

The FTC Safeguards Rule applies to financial institutions including accounting practices that handle customer financial information. IRS Publication 4557 sets expectations for tax professionals to safeguard taxpayer data.

Naming these regulations tells leadership this is not optional. Non-compliance carries real legal and financial consequences.

Now click into the Risk Heat Map Summary placeholder section.
Create a small table or formatted list showing the number of risks at each severity level (Critical, High, Moderate, Low) so the reader can see the distribution at a glance.

Use color in your heat map

In Google Docs, highlight the severity labels with matching cell or text colors: red for Critical, orange for High, yellow for Moderate, green for Low. This makes the distribution instantly scannable for a busy executive.

Your Key Findings and Risk Heat Map Summary sections are now complete. Scroll through them and confirm they present a clear picture of how many risks exist and where the biggest gaps are.

Write prioritized recommendations

Findings without recommendations leave leadership stuck. Each recommendation ties directly to a gap you identified, giving the firm a clear path from "problem" to "action."

Click into the Recommendations placeholder section of your Google Doc.
Write 3-5 prioritized recommendations, each following this structure: what to do, which CSF gap it closes, estimated effort (quick win, medium-term, or long-term), and why it matters.

What does a good recommendation look like?

Each recommendation answers four questions for leadership: What action should we take? Which gap does it close? How long will it take? Why should we care?

For example: "Implement security awareness training (closes PR.AT gap). Quick win. Reduces the likelihood of phishing-based credential theft, currently the highest-scored risk."

Ensure each recommendation references a specific CSF category ID (like PR.AT, DE.CM, or RS.MA) so the reader can trace it back to your Controls Mapping.
Order your recommendations from quick wins to long-term investments so leadership sees immediate options first.

Not sure which gaps to prioritize?

Return to your Controls Mapping tab and look at the "Not Implemented" entries that have Related Risk IDs pointing to your Critical or High risks. Those are your highest-priority recommendations because they address the most severe risks.

Help me decide which gaps to turn into recommendations based on my risk register scores.

Review the entire Google Doc from top to bottom.
Confirm the document fits on one page. If it runs over, tighten your wording in the Assessment Overview or reduce the Risk Heat Map Summary to a compact table.

Before you declare this done, ask yourself: if you were a board member seeing this document for the first time, would you know exactly how much risk the firm carries and what to do about it?

Why one page?

Executives have limited time and competing priorities. A one-page constraint forces you to prioritize ruthlessly, which is exactly what leadership needs. The detailed evidence lives in your spreadsheet for anyone who wants to dig deeper.

Your executive summary is complete. You now have a one-page document that communicates the firm's risk posture in language a board member can act on, backed by the detailed risk register and controls mapping in your spreadsheet.

Secret mission

Build a Plan of Action and Milestones (POA&M)

You have identified the risks and mapped the gaps. But a real GRC Analyst does not stop at diagnosis. Can you build the remediation roadmap that auditors and regulators actually expect to see on file?

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely on Google Sheets and Google Docs, so there are no ongoing costs.

Resources you used:

Google Sheets workbook: Greenfield & Associates - Risk Assessment (4 tabs: Asset Inventory, Risk Register, Controls Mapping, POA&M).
Google Doc: Greenfield & Associates - Executive Summary.

Keep everything running

No action needed. Choose this if you want your deliverables ready for job applications and portfolio sharing.

Your Google Sheets workbook and Google Doc remain in your Google Drive at no cost.
To make them portfolio-ready, open each file and click Share, then set access to Anyone with the link as a Viewer. This gives you a shareable URL for job applications and LinkedIn.
Consider duplicating the workbook and adapting the scenario to a different industry (healthcare with HIPAA, or retail with PCI-DSS) to demonstrate range in your portfolio.

Pause - I'll come back to this later

Since everything lives in Google Drive, there is nothing to shut down or pause. Your files stay accessible whenever you return.

Your Google Sheets workbook and Google Doc will remain in your Drive indefinitely at no charge.
If you want to tidy your Drive in the meantime, move both files into a dedicated folder (e.g., GRC Portfolio Projects) so you can find them easily later.

Delete - I don't want to use this again

Remove all project files from your Google Drive entirely.

Open Google Drive in your browser.
Find the file Greenfield & Associates - Risk Assessment. Right-click it and select Move to trash.
Find the file Greenfield & Associates - Executive Summary. Right-click it and select Move to trash.
To permanently delete, click Trash in the left sidebar, then click Empty trash at the top right.

Nice Work!

You just completed a professional risk assessment using NIST CSF 2.0 for a fictional accounting firm. You now have three shareable, portfolio-ready deliverables that prove to hiring managers you can do the job on day one.

You've learned how to:

Construct a scored risk register with 10+ cybersecurity risks using the industry-standard 5x5 likelihood-impact matrix, turning vague security concerns into prioritized, scorable entries that drive decisions.
Map controls to all six CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) and identify systemic gaps that a flat risk list alone cannot reveal.
Write a one-page executive summary that translates technical findings into prioritized recommendations a board member can act on.
Secret Mission: Created a POA&M with risk treatment plans, milestones, and residual risk calculations for all Critical and High risks.

Ready to quiz yourself?