Cybersecurity Risk Assessment

Introduction

30 Second Summary

Every company, from tiny startups to massive enterprises, faces cybersecurity threats. The people who identify those threats, figure out how bad they could be, and recommend what to fix first are called GRC (Governance, Risk, and Compliance) analysts.

In this project, you will build a complete cybersecurity risk assessment for a fictional SaaS startup called NovaTech Solutions. You will identify risks, score them using a 5x5 matrix, create a treatment plan, and publish everything to GitHub as a portfolio artifact that proves you can do day-one GRC analyst work.

What You'll Build

A portfolio-ready risk assessment package in Google Sheets that uses a qualitative 5x5 likelihood/impact matrix to identify, score, and prioritize 10 cybersecurity risks for a fictional Linux-based tech startup.

By the end of this project, you'll have:

• A risk register with 10 identified risks scored for both inherent and residual risk using a 5x5 matrix.
• A risk treatment plan with prioritized remediation actions, owners, and timelines mapped to NIST CSF 2.0.
• A one-page executive summary that communicates technical findings to non-technical leadership.
• Secret Mission: Add a NIST CSF 2.0 control mapping that ties each risk to specific CSF subcategories.

Are there any prerequisites?

None. This project uses Google Sheets (free) and GitHub (free), and walks you through setting up everything from scratch. Your existing Linux knowledge will help you understand the fictional company's infrastructure.

Set Up Your Workspace

Every risk assessment starts with defining the scope. Before you can identify threats or score risks, you need a structured workspace that mirrors how professional GRC analysts organize their work.

In this step, you'll create a Google Sheets workbook with dedicated tabs for each deliverable, set up a GitHub repository to host your finished portfolio, and document the fictional company's profile that drives the entire assessment.

In this step, get ready to:

• Create a Google Sheets workbook with four organized tabs.
• Create a GitHub repository to host your portfolio artifacts.
• Document NovaTech Solutions' company profile.

Create your Google Sheets workbook

Your risk assessment needs a central home. A single Google Sheets workbook with dedicated tabs keeps everything organized and makes it easy to cross-reference between your risk register, heatmap, and treatment plan.

Any Google account works

You can use a personal Gmail account or a work/school Google Workspace account. If you already have Google Drive open, you are ready to go.

• Open your browser and navigate to sheets.google.com.
• Sign in with your Google account if prompted.
• Click Blank to create a new spreadsheet.
• Click the title at the top that says Untitled spreadsheet.
• Type NovaTech Risk Assessment and press Enter.

Now you need to set up four tabs for each deliverable in your assessment.

• Double-click the existing tab at the bottom of the screen (it says Sheet1).
• Type Company Profile and press Enter.
• Click the + button at the bottom-left to add a new tab.
• Double-click the new tab and rename it to Risk Register.
• Click + again to add another tab.
• Double-click and rename it to Risk Heatmap.
• Click + one more time.
• Double-click and rename it to Treatment Plan.

You should now see four tabs at the bottom of your spreadsheet: Company Profile, Risk Register, Risk Heatmap, and Treatment Plan.

Why four separate tabs?

Each tab represents a distinct deliverable in a professional risk assessment. Keeping them separate mirrors how GRC teams organize their work.

It also makes it easier for hiring managers reviewing your portfolio to navigate directly to the piece they want to see.

💡 Why Google Sheets instead of Excel?

Google Sheets is free, instantly shareable via a link, and exports cleanly to .xlsx for GitHub. Most entry-level GRC teams use spreadsheets for risk registers because they are lightweight and universally understood.

Enterprise tools like ServiceNow GRC or Archer exist, but they require paid licenses. Proving you can do the analytical work in a simple spreadsheet is what hiring managers want to see at this level.

Create your GitHub repository

Your finished risk assessment needs a public home where hiring managers can review it. GitHub is the standard platform for hosting GRC portfolio artifacts.

• Open a new browser tab and navigate to github.com.

✔️ I already have a GitHub account

• Sign in with your existing credentials.

You're all set. Continue with the repository creation steps below.

ⓧ I need to create a GitHub account

• Click Sign up on the GitHub homepage.
• Enter your email address, create a password, and choose a username.
• Complete the verification steps and confirm your email.
• Sign in with your new account.

Once signed in, continue with the repository creation steps below.

Now create the repository that will host your risk assessment portfolio.

• In the upper-right corner of any page, click the + icon, then click New repository.
• In the Repository name box, type grc-risk-assessment.
• Select Public for the repository visibility.
• Toggle Add a README file to On.
• Click Create repository.

You should now see your new repository page with a README.md file listed. You'll update this README with project details in a later step.

Why GitHub for a GRC portfolio?

Hosting GRC artifacts on GitHub is an established practice in the cybersecurity field. It demonstrates you can organize and document your work professionally.

Hiring managers reviewing your profile can browse your deliverables directly without needing to download files.

🙋‍♀️ Repository name already taken?

GitHub requires unique repository names within your account. If grc-risk-assessment is taken, try grc-risk-assessment-novatech or cybersecurity-risk-assessment.

Also confirm you toggled Add a README file to On before clicking Create. Without it, you will see an empty setup page instead of the repository file list.

Help me create my GitHub repository.

Document the company profile

A risk assessment is only meaningful when grounded in a specific context. The company profile establishes who NovaTech is, what they protect, and what regulations apply. This information drives every risk you identify later.

• Switch back to your Google Sheets browser tab.
• Click the Company Profile tab at the bottom of the screen.
• In cell A1, type Field. In cell B1, type Details.

Now fill in the company details starting from row 2. Enter each field in column A and its corresponding value in column B.

• Row 2: A2 = Company Name, B2 = NovaTech Solutions.
• Row 3: A3 = Company Type, B3 = 40-person B2B SaaS startup.
• Row 4: A4 = Product, B4 = HR management software.
• Row 5: A5 = Infrastructure, B5 = Ubuntu Linux servers on AWS (EC2, RDS, S3).
• Row 6: A6 = Data Handled, B6 = Employee PII (names, SSNs, addresses, salary data).
• Row 7: A7 = Regulatory Context, B7 = Subject to SOC 2 requirements from enterprise customers, and state privacy laws.
• Row 8: A8 = Security Posture, B8 = Basic - no formal security program, one IT admin, no dedicated security team.

Why does this context matter?

The company profile is not just background fluff. Every detail drives your risk scoring later.

For example, handling SSNs with only one IT admin and no formal security program means the impact of a data breach is high and the likelihood of one is elevated. The SOC 2 regulatory context also means NovaTech faces contractual risk.

💡 Make it look professional

Bold your column headers in row 1 and widen column B so the longer values display fully. Professional formatting makes your portfolio artifact stand out when hiring managers review it.

Your workspace is ready. You have a structured workbook, a GitHub repository, and a company profile that gives your risk assessment real context. Next up, you'll build your risk register and identify 10 cybersecurity risks facing NovaTech.

Build Your Risk Register

Your workspace is ready with all four sheets and a detailed company profile. Now it's time to build the core deliverable of any risk assessment: the risk register.

A risk register is a structured document that captures every identified threat to an organization, describes it clearly, and tracks how it's being handled. Think of it as a master list that keeps security risks visible and actionable instead of floating around in someone's head.

In this step, get ready to:

• Set up 19 columns in your Risk Register sheet to capture every detail about each risk.
• Identify 10 cybersecurity risks relevant to NovaTech's environment.
• Write professional risk descriptions using the Cause-Event-Consequence format.

Set up the Risk Register columns

A well-structured risk register needs columns that track the full lifecycle of each risk. You'll create columns for identification, scoring, controls, and ownership.

• Switch to the Risk Register tab in your NovaTech Risk Assessment workbook.
• In row 1, enter the following 19 column headers across cells A1 through S1:

• A1: Risk ID
• B1: Risk Title
• C1: Risk Description
• D1: Risk Category
• E1: Threat Source
• F1: Affected Asset
• G1: Likelihood (1-5)
• H1: Impact (1-5)
• I1: Inherent Risk Score
• J1: Inherent Risk Level
• K1: Existing Controls
• L1: Control Effectiveness
• M1: Residual Likelihood
• N1: Residual Impact
• O1: Residual Risk Score
• P1: Residual Risk Level
• Q1: Risk Owner
• R1: Treatment Strategy
• S1: Status

• Bold the entire header row by selecting row 1 and pressing Cmd+B (macOS) or Ctrl+B (Windows).

Why so many columns?

The first six columns (Risk ID through Affected Asset) identify the risk. The middle columns (Likelihood through Residual Risk Level) score it. The final columns (Risk Owner through Status) track how it's being handled.

You'll fill in the scoring columns in the next step. For now, focus on identifying and describing your risks clearly.

💡 What is inherent vs. residual risk?

Inherent risk is the risk level before any controls are applied. Residual risk is what remains after existing controls reduce the likelihood or impact. Tracking both shows whether current safeguards are actually working.

Learn the Cause-Event-Consequence format

Professional risk descriptions follow the Cause-Event-Consequence (CEC) format. This structure separates the root cause from the event and its business impact, making each risk easier to score and treat.

The pattern is: "Due to [cause], [event] may occur, resulting in [consequence]."

Why use Cause-Event-Consequence?

Vague descriptions like "server security issue" give you nothing to act on. CEC forces you to name the specific gap (cause), what could happen (event), and why it matters to the business (consequence).

This makes scoring more accurate because you can clearly see what drives the likelihood (cause) and what drives the impact (consequence).

Here is an example of a well-written CEC risk description for NovaTech:

• Risk Title: Unpatched Linux Servers
• Risk Description: "Due to the absence of automated patch management on Ubuntu servers, known vulnerabilities may remain unpatched for extended periods, resulting in potential exploitation by attackers and unauthorized access to customer PII."
• Risk Category: Vulnerability Management.
• Threat Source: External attackers, automated scanning tools.
• Affected Asset: EC2 instances (Ubuntu Linux servers).

Document your 10 cybersecurity risks

Now that you know the format, it's time to identify 10 risks that are realistic for NovaTech's environment. Remember that NovaTech runs Ubuntu Linux on AWS, handles employee PII, has only one IT admin, and no formal security program.

• Starting in row 2 of your Risk Register sheet, enter each risk with an ID from R001 through R010.
• For each risk, fill in columns A through F only (Risk ID, Risk Title, Risk Description, Risk Category, Threat Source, Affected Asset).
• Leave columns G through S blank for now. You'll score and assign these in the next step.

Use the following 10 risks. Write a full CEC description for each one:

• R001 - Unpatched Linux Servers (Vulnerability Management). Affected asset: EC2 instances.
• R002 - Weak SSH Access Controls (Access Control). Affected asset: EC2 instances, SSH service.
• R003 - Unencrypted Data at Rest in S3 (Data Protection). Affected asset: S3 buckets containing customer PII.
• R004 - No Incident Response Plan (Incident Response). Affected asset: Entire organization.
• R005 - Single IT Admin as Single Point of Failure (Human Factor). Affected asset: IT operations, all systems.
• R006 - Lack of MFA on AWS Console (Access Control). Affected asset: AWS management console, all cloud resources.
• R007 - No Vendor Security Assessments (Third-Party Risk). Affected asset: Third-party integrations, customer data shared with vendors.
• R008 - No Employee Security Awareness Training (Human Factor). Affected asset: All employees, email systems.
• R009 - Inadequate Backup Testing (Data Protection). Affected asset: RDS databases, S3 data.
• R010 - Overly Permissive IAM Policies (Access Control). Affected asset: AWS IAM, all cloud resources.

Make each description unique

Don't copy the same sentence structure for all 10. Vary your CEC descriptions by focusing on different causes (missing policy, no automation, lack of training) and different consequences (data breach, regulatory fines, operational downtime, reputational damage).

Want to check that your CEC descriptions hit the mark?

✔️ I'll try it first

Go for it. Write all 10 descriptions using the CEC pattern, then come back and compare if you want to double-check.

ⓧ Let me check my work

Here are two more example CEC descriptions you can compare yours against:

• R002 - Weak SSH Access Controls: "Due to the use of password-based SSH authentication without key-pair enforcement, brute-force attacks may succeed in gaining server access, resulting in unauthorized control of production systems and potential data exfiltration."
• R006 - Lack of MFA on AWS Console: "Due to the absence of multi-factor authentication on AWS management console accounts, credential theft via phishing may grant attackers full cloud access, resulting in unauthorized infrastructure changes and potential deletion of production resources."

Each description clearly separates the gap (cause), what could happen (event), and why it matters to the business (consequence).

• After entering all 10 risks, review column C (Risk Description) to confirm every entry follows the "Due to [cause], [event] may occur, resulting in [consequence]" pattern.

Running out of space for descriptions?

If your descriptions are getting cut off in the cells, widen column C by double-clicking the column border between C and D in the header row. This auto-fits the column to your longest entry.

You can also enable text wrapping by selecting column C, then clicking Format in the top menu, selecting Wrapping, and choosing Wrap.

Having trouble writing CEC descriptions? Help me write a Cause-Event-Consequence risk description for a specific scenario.

💡 What are the 8 risk categories?

The categories you've used map to common security domains. Access Control covers authentication and authorization gaps. Data Protection covers encryption and backup issues. Vulnerability Management covers patching and hardening.

The remaining categories are Network Security, Incident Response, Third-Party Risk, Physical Security, and Human Factor. Together these categories ensure you're covering threats from every angle, not just technical ones.

💡 Extra for Experts: How many risks do real enterprises track?

Large organizations often maintain risk registers with 50-100+ entries across multiple business units. NovaTech's 10 risks represent a focused starter set that covers the most common domains.

The skill hiring managers evaluate is not the quantity of risks but the quality of your analysis. Ten well-described, accurately scored risks demonstrate stronger analytical thinking than 50 vague entries.

You now have a solid foundation of 10 identified risks. Next up, you'll score each one using a 5x5 likelihood and impact matrix to determine which risks need the most urgent attention.

Score Your Risks

Your risk register has 10 risks identified, but right now they're all sitting on the same level. Without scoring, a hiring manager looking at your register has no way to tell which risks need immediate attention and which ones can wait.

In this step, you'll assign likelihood and impact scores to each risk using a qualitative risk assessment methodology. You'll also build a visual heatmap that makes your highest-priority risks impossible to miss.

In this step, get ready to:

• Score all 10 risks for inherent likelihood and impact using a 5x5 matrix.
• Build a color-coded risk heatmap for visual prioritization.
• Assess existing controls and calculate residual risk scores.

Define your scoring scales and score inherent risk

Before you can score any risks, you need a consistent scale. The 5x5 likelihood/impact matrix is the industry-standard approach for qualitative risk assessments.

• Switch to your Risk Register tab in Google Sheets.
• Select a blank area to the right of your columns (or insert a comment on cell G1) and add the following scoring reference so you can look it up while scoring:

Likelihood scale:

• 1 = Rare (<10% chance of occurring).
• 2 = Unlikely (10-30%).
• 3 = Possible (30-60%).
• 4 = Likely (60-80%).
• 5 = Almost Certain (>80%).

Impact scale:

• 1 = Negligible (minimal disruption).
• 2 = Minor (small financial or operational effect).
• 3 = Moderate (significant but recoverable).
• 4 = Major (severe financial loss or regulatory penalty).
• 5 = Catastrophic (business-threatening or large-scale data breach).

What is inherent risk?

Inherent risk is the risk level BEFORE any controls are applied. It answers the question: "How bad would this be if we did nothing about it?"

You'll calculate residual risk (after controls) later in this step. Separating the two shows a hiring manager you understand the full risk lifecycle.

💡 Why qualitative scoring instead of quantitative?

Quantitative methods like FAIR assign dollar values to risks, which requires historical loss data most startups do not have. The qualitative 5x5 matrix works with expert judgment alone.

Entry-level GRC roles almost always use qualitative scoring. Quantitative analysis is a senior-level skill. Master the 5x5 matrix first.

• For each of your 10 risks (R001 through R010), enter a value between 1-5 in the Likelihood column (column G).
• Enter a value between 1-5 in the Impact column (column H) for each risk.

Here are suggested scores for three of your risks to help you calibrate:

• R001 - Unpatched Linux Servers: Likelihood 4 (Likely — one IT admin with no automated patching), Impact 4 (Major — exploited servers expose customer PII).
• R004 - No Incident Response Plan: Likelihood 5 (Almost Certain — incidents will occur eventually), Impact 3 (Moderate — without a plan, response is slow but the event itself varies).
• R009 - Inadequate Backup Testing: Likelihood 3 (Possible — backups may exist but untested), Impact 4 (Major — unrecoverable data loss if backups fail during an incident).

How do I decide on scores?

Think about NovaTech's specific situation when scoring. A company with one IT admin and no patch management process would score high on likelihood (4 or 5) for unpatched servers.

A data breach exposing customer PII (SSNs, salary data) would score high on impact (4 or 5). Let the company profile drive your numbers.

• In the Inherent Risk Score column (column I), calculate the score for each risk using the formula: Likelihood x Impact.
• You can type a Google Sheets formula like =G2*H2 in cell I2, then drag it down to I11 to auto-calculate for all 10 risks.
• In the Inherent Risk Level column (column J), map each score to its level:

• 1-4 = Low (green).
• 5-9 = Medium (yellow).
• 10-15 = High (orange).
• 16-25 = Critical (red).

Use conditional formatting for risk levels

Select your Inherent Risk Level column, then click Format in the top menu bar and select Conditional formatting. Add rules for each level text ("Low", "Medium", "High", "Critical") with the corresponding background color. This makes your register instantly scannable.

🙋‍♀️ Scores not calculating?

Make sure your Likelihood and Impact columns contain only numbers (1-5), not text. If you typed "3 - Possible" instead of just 3, the multiplication formula will return an error.

Why aren't my risk scores calculating in Google Sheets?

Build your risk heatmap

A risk heatmap turns your numerical scores into a visual tool that makes risk distribution obvious at a glance. This is the artifact hiring managers and executives reference most often.

• Switch to your Risk Heatmap tab.
• In column A (starting from row 2), enter the Likelihood labels from top to bottom: Almost Certain, Likely, Possible, Unlikely, Rare.
• In row 1 (starting from column B), enter the Impact labels from left to right: Negligible, Minor, Moderate, Major, Catastrophic.

This creates your 5x5 grid. The intersection of each row and column represents a specific risk score (Likelihood x Impact).

What is a risk heatmap?

A risk heatmap is a color-coded matrix where green (bottom-left) represents low risk and red (top-right) represents critical risk. Plotting Risk IDs onto this grid creates an instant visual summary that executives and auditors reference more than any other artifact in your assessment.

• Apply conditional formatting to color-code the 25 cells of your matrix. Select cells B2 through F6.
• Click Format in the top menu bar.
• Click Conditional formatting.
• Add formatting rules to apply background colors based on the score each cell represents. Use green for scores 1-4, yellow for 5-9, orange for 10-15, and red for 16-25.

How do I know which color goes where?

Each cell's score is the row's likelihood value multiplied by the column's impact value. For example, the cell at row "Possible" (3) and column "Major" (4) has a score of 12, which falls in the High (orange) range.

You can manually color each cell, or type the numeric scores (1-25) into cells first, apply conditional formatting rules, then replace the numbers with Risk IDs.

🙋‍♀️ Conditional formatting not applying?

Make sure you selected the correct cell range (B2 through F6) before opening the conditional formatting panel. If you selected the entire sheet, the rules will apply to every cell.

Also check that the format rule condition is set to Text contains (not "Text is exactly") when matching your risk level labels. If your cells have leading or trailing spaces, "Text is exactly" will not match.

Help me set up conditional formatting for my risk heatmap.

• Plot your 10 risks onto the heatmap. For each risk, find the cell that matches its Likelihood row and Impact column, then type the Risk ID (e.g., R001) into that cell.
• If multiple risks share the same cell, list them together separated by a comma (e.g., R003, R007).

Your heatmap should now show a clear visual distribution. You should see some risks clustered in the orange and red zones (upper-right), with others in the green and yellow zones (lower-left).

All your risks landing in the same cell?

If most of your risks have identical scores, revisit your Likelihood and Impact assessments. Think about NovaTech's specifics. A company with one IT admin is more likely to have unpatched servers (Likelihood 4-5) than to experience a physical break-in (Likelihood 1-2). Vary your scores to reflect realistic differences between threats.

Help me differentiate my risk scores for a realistic heatmap distribution.

Assess existing controls and calculate residual risk

Inherent risk tells you the worst case. But NovaTech already has some protections in place, even if they're basic. Residual risk captures the risk level AFTER accounting for those existing controls.

• Switch back to your Risk Register tab.
• For each of the 10 risks, fill in the Existing Controls column (column K). Document what NovaTech already has in place, even if it's minimal.

For example, NovaTech's single IT admin likely performs some ad-hoc patching (even if it's inconsistent), and AWS provides default encryption options (even if not all are enabled).

• In the Control Effectiveness column (column L), rate how effective each existing control is. Use a simple scale: None, Low, Moderate, or High.
• Based on control effectiveness, assign a Residual Likelihood (column M) and Residual Impact (column N) for each risk. These should be equal to or lower than the inherent scores.
• Calculate the Residual Risk Score in column O using the same formula: Residual Likelihood x Residual Impact. You can use =M2*N2 and drag down.
• Fill in the Residual Risk Level column (column P) using the same scale: 1-4 Low, 5-9 Medium, 10-15 High, 16-25 Critical.

Why does residual risk matter?

The gap between inherent and residual risk shows how much value existing controls provide. A risk that drops from Critical (20) to High (12) has decent controls. A risk that stays Critical after controls signals an urgent gap that needs new investment.

Demonstrating this distinction in your register proves you think beyond just listing problems. You understand the full picture of risk management.

💡 Keep residual scores realistic

Controls with "Low" effectiveness should only reduce likelihood or impact by 1 point at most. Controls with "None" effectiveness mean the residual score stays the same as inherent. A risk with no existing control should have identical inherent and residual scores.

🙋‍♀️ Residual risk higher than inherent risk?

Residual scores should never exceed inherent scores. Controls can only reduce risk, not increase it. If your residual numbers are higher, double-check that your Residual Likelihood and Residual Impact values are not accidentally higher than the original Likelihood and Impact values in columns G and H.

Help me make sure my residual risk scores are logically consistent.

Your risks are now fully scored with both inherent and residual values, and your heatmap makes the biggest threats impossible to miss. Next up, you'll turn these scores into action by building a treatment plan that tells NovaTech exactly what to fix and when.

Create a Risk Treatment Plan

You now have a fully scored risk register and a visual heatmap showing where NovaTech's biggest dangers cluster. Scoring risks is only half the job. The other half is deciding what to do about them.

In this step, you will build a risk treatment plan that assigns a strategy and concrete remediation actions to every risk. You will also write an executive summary that communicates your findings to non-technical leadership.

In this step, get ready to:

• Set up the Treatment Plan sheet with columns and assign a treatment strategy to each risk.
• Write specific remediation actions for High and Critical risks with a prioritized timeline.
• Create an executive summary tab communicating your top findings to leadership.

Set up the Treatment Plan structure and assign strategies

Every identified risk needs a treatment decision. The four standard treatment strategies are Mitigate (reduce likelihood or impact), Transfer (shift to a third party, such as cyber insurance), Accept (document a conscious decision to take no action), and Avoid (eliminate the activity causing the risk).

• Switch to the Treatment Plan tab in your NovaTech Risk Assessment spreadsheet.
• In row 1, create the following column headers: Risk ID, Risk Title, Inherent Risk Level, Residual Risk Level, Treatment Strategy, Treatment Actions, Responsible Party, Target Date, Priority, Status.
• Copy the Risk ID, Risk Title, Inherent Risk Level, and Residual Risk Level values for all 10 risks from your Risk Register tab into the corresponding columns.
• For each risk, enter a treatment strategy in the Treatment Strategy column: Mitigate, Transfer, Accept, or Avoid.

How do I choose a treatment strategy?

Most risks in a startup environment will be Mitigate because the company wants to reduce them through controls. Use Transfer when insurance or outsourcing makes more sense than fixing it in-house.

Use Accept when the residual risk is Low and the cost of further reduction is not justified. Use Avoid when the activity causing the risk can be eliminated entirely. For NovaTech, expect the majority of your 10 risks to use Mitigate, with only 1-2 falling into Transfer or Accept.

💡 How does this connect to NIST CSF 2.0?

Your treatment plan directly fulfills NIST CSF 2.0's Risk Assessment category (ID.RA), which calls for organizations to document cybersecurity risks and determine appropriate responses.

When you assign treatment strategies and timelines, you are demonstrating the exact workflow NIST expects. This connection strengthens your portfolio for employers who use NIST as their security framework.

Write remediation actions with prioritized timelines

A treatment strategy alone does not fix anything. For every risk rated High or Critical, you need specific actions, an owner, and a deadline.

• For each risk with an Inherent Risk Level of Critical or High, write a specific remediation action in the Treatment Actions column.
• Assign a Responsible Party for each risk (for NovaTech, this is usually IT Admin or a relevant department head).
• Set the Target Date using this prioritized roadmap: 0-30 days for Critical items, 30-90 days for High items, 90+ days for Medium items.
• Set the Priority column to match: Critical, High, or Medium.
• Set the Status column to Planned for all risks (since NovaTech has not started remediation yet).

What does a good treatment action look like?

Treatment actions should be specific and implementable. Compare these two examples:

• Vague: "Fix the patching problem."
• Specific: "Implement automated patch management using unattended-upgrades on all Ubuntu servers. Configure weekly security patches and monthly full updates."

A hiring manager reading your treatment plan should be able to hand it to a sysadmin and have them start working immediately.

Here is an example of a complete treatment row for R001 (Unpatched Linux Servers):

• Treatment Strategy: Mitigate.
• Treatment Actions: Implement automated patch management using unattended-upgrades on all Ubuntu servers. Configure weekly security patches and monthly full updates. Add monitoring to alert on patch failures.
• Responsible Party: IT Admin.
• Target Date: 0-30 days.
• Priority: Critical.
• Status: Planned.

What about Medium and Low risks?

Medium risks still get a Treatment Strategy and a target date in the 90+ days range. Low risks can use the Accept strategy with a brief justification (e.g., "Risk within tolerance, monitor quarterly"). Every row should be filled in.

Write the executive summary

A risk assessment is only useful if leadership reads and acts on it. The executive summary distills your entire analysis into a one-page document that a CEO or board member can understand in five minutes.

• Click the + icon next to your existing sheet tabs at the bottom of Google Sheets to add a new tab.
• Double-click the new tab name and rename it to Executive Summary.
• In the Executive Summary tab, write a one-page summary with the following sections (use one section per row or merge cells for readability):

• Purpose - State the goal of the assessment (e.g., to identify and prioritize cybersecurity risks affecting NovaTech Solutions).
• Scope - Describe NovaTech's environment: 40-person SaaS startup, Ubuntu Linux servers on AWS (EC2, RDS, S3), employee PII, SOC 2 requirements.
• Methodology - Explain you used a qualitative 5x5 likelihood/impact matrix to score both inherent and residual risk.
• Key Findings - List the top 3-5 risks by inherent risk score. Name each risk and its score.
• Recommendations - List the top priority remediation actions from your Treatment Plan (the 0-30 day items).
• Risk Posture Statement - Write a summary sentence such as: "NovaTech currently has 3 Critical and 4 High risks requiring immediate attention." Use your actual numbers from the Risk Register.

Why write an executive summary?

GRC analysts rarely present raw spreadsheets to leadership. The executive summary proves you can translate technical risk data into business language. This is the single most important communication skill for a GRC role.

Keep your summary to one printed page. Use short paragraphs and bullet points. If a section runs longer than 3-4 sentences, cut it down. Leadership wants clarity, not detail.

• Review your executive summary and confirm it avoids technical jargon. A non-technical executive should understand every sentence.

Not sure what to write in Key Findings?

Go back to your Risk Register tab and sort by Inherent Risk Score (highest first). Pick the top 3-5 risks. For each one, write one sentence explaining the risk and its score in plain language.

Replace technical terms with business language. Instead of "unpatched CVEs on EC2 instances," write "outdated security updates on our servers." Instead of "lack of MFA," write "single-password access to critical systems."

Help me write my key findings section.

Your risk assessment package is complete with a scored register, a visual heatmap, a treatment plan with timelines, and a leadership-ready executive summary. Next up, you will publish everything to GitHub as a professional portfolio artifact.

Publish to GitHub

Your risk assessment is complete. You have a scored risk register, a visual heatmap, a prioritized treatment plan, and an executive summary that communicates findings to leadership.

Now it's time to package everything and publish it to GitHub as a professional portfolio artifact. Hiring managers reviewing your profile will see a complete, organized risk assessment that proves you can do day-one GRC analyst work.

In this step, get ready to:

• Export your workbook as downloadable files.
• Upload all artifacts to your GitHub repository with a professional README.
• Review your repository from a hiring manager's perspective.

Export your Google Sheets workbook

GitHub displays certain file formats better than others. Spreadsheet data works best as an .xlsx file, while text-heavy documents like your Company Profile and Executive Summary are easier to read as PDF or Markdown files.

• In your NovaTech Risk Assessment spreadsheet, click File in the top menu bar.
• Hover over Download.
• Select Microsoft Excel (.xlsx).

This downloads your entire workbook (all five tabs) as a single .xlsx file. The Risk Register, Risk Heatmap, and Treatment Plan tabs are all included.

Why export the whole workbook?

A single .xlsx file keeps your scored data, heatmap, and treatment plan together. Hiring managers can open one file and see the full analytical picture without hunting across multiple downloads.

Next, export your text-heavy tabs as separate files for easy reading on GitHub.

• Click the Company Profile tab at the bottom of your spreadsheet to switch to it.
• Click File in the top menu bar.
• Hover over Download.
• Select PDF (.pdf).
• In the PDF export dialog, select Current sheet under the export option, then click Export.
• Repeat the same PDF export for the Executive Summary tab.

Rename your downloaded files

Rename your exported files to something clean and professional before uploading. Use names like NovaTech-Risk-Assessment.xlsx, Company-Profile.pdf, and Executive-Summary.pdf.

You should now have three files in your Downloads folder: one .xlsx file and two .pdf files.

Upload your artifacts to GitHub

Your grc-risk-assessment repository currently only has a default README. You will upload your exported files and update the README to explain what this project is.

• Return to your grc-risk-assessment repository on GitHub.
• Click Add file in the top right area of the file list.
• Select Upload files.
• Drag or choose your three files: NovaTech-Risk-Assessment.xlsx, Company-Profile.pdf, and Executive-Summary.pdf.
• In the Commit changes section at the bottom, type a commit message like Add risk assessment artifacts.
• Click Commit changes.

Your repository now shows all three files alongside the README.md.

Files not uploading?

GitHub has a 25 MB file size limit for browser uploads. Your .xlsx and .pdf files should be well under this limit. If you see an error, check that you are dragging the correct files from your Downloads folder.

If the upload button is greyed out, make sure you are on the repository's main page (not inside a file view). Navigate back to github.com/YOUR-USERNAME/grc-risk-assessment and try again.

Now update the README to explain your project professionally.

• Click the README.md file in your repository.
• Click the pencil icon (edit button) in the top right corner of the file view.
• Replace the default content with a professional README that includes the following sections:

• Project title: "Cybersecurity Risk Assessment - NovaTech Solutions".
• Objective: A brief statement of what this assessment accomplishes.
• Methodology: Qualitative risk assessment using a 5x5 likelihood/impact matrix.
• Framework reference: NIST CSF 2.0 (NIST CSWP 29).
• Deliverables list: Name each file in the repository and what it contains.
• Skills demonstrated: Risk identification, qualitative risk scoring, risk treatment planning, executive communication.

Here is an example of what the beginning of your README could look like in Markdown:

# Cybersecurity Risk Assessment - NovaTech Solutions

## Objective
Identify, score, and prioritize cybersecurity risks for a 40-person B2B SaaS startup handling sensitive employee data.

## Methodology
Qualitative risk assessment using a 5x5 likelihood/impact matrix with both inherent and residual scoring.

## Framework Reference
NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29)

## Deliverables
- `NovaTech-Risk-Assessment.xlsx` - Risk register, heatmap, and treatment plan
- `Company-Profile.pdf` - Company context and scope
- `Executive-Summary.pdf` - One-page leadership brief

## Skills Demonstrated
- Risk identification using Cause-Event-Consequence format
- Qualitative risk scoring (inherent and residual)
- Risk treatment planning with prioritized timelines
- Executive communication of technical findings

Why does the README matter so much?

The README is the first thing a hiring manager sees when they open your repository. It acts as a cover page that frames your work and demonstrates written communication skills.

A well-structured README signals that you can document and present security work clearly. That is a core part of any GRC analyst role.

• After editing, click Commit changes in the top right.
• Add a commit message like Update README with project details and click Commit changes.

Review your repository like a hiring manager

Before sharing this repository with anyone, review it from the perspective of someone evaluating your GRC skills. A hiring manager scanning your GitHub profile spends about 30 seconds deciding if a repository is worth a deeper look.

• Navigate back to the main page of your grc-risk-assessment repository.
• Confirm the README renders below the file list and clearly explains what this project is.
• Click each uploaded file to confirm it is accessible and opens without errors.
• Check that the repository visibility is set to Public. Click Settings in the top navigation, scroll to the Danger Zone section, and verify it says "Public."

Use this checklist to evaluate your repository's professionalism:

• The README clearly explains what this is and what methodology you used.
• Each artifact is accessible and professionally named.
• Risk descriptions in your register use proper terminology (Cause-Event-Consequence format).
• The executive summary demonstrates business communication skills (non-technical language, clear recommendations).

Make it scannable

If your README feels like a wall of text, add Markdown headings (##) to break it into sections. Bullet points for the deliverables list and skills section also help a busy reader find what they need quickly.

🙋‍♀️ Repository showing as private?

If your repository is private, go to Settings, scroll to the Danger Zone section, and click Change visibility. Select Public and confirm. You need a public repository for hiring managers to view your work without needing access permissions.

Help me make my GitHub repository public.

💡 Share your work on LinkedIn

Copy your repository URL and share it in a LinkedIn post. Mention the methodology you used (qualitative 5x5 matrix), the framework you referenced (NIST CSF 2.0), and what the project demonstrates (risk identification, scoring, and treatment planning).

Hiring managers actively search LinkedIn for candidates showing hands-on GRC work. A single post linking to your repository puts your skills in front of the right audience.

Secret mission

Map Risks to NIST CSF 2.0

Your risk register is solid, but enterprise employers want to see you connect risks to recognized frameworks. In this secret mission, you'll map each of your 10 risks to specific NIST CSF 2.0 Functions and Categories, proving you can speak the language hiring managers expect.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely on free services (Google Sheets and GitHub), so there are no ongoing costs. Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

• Google Sheets workbook: "NovaTech Risk Assessment" (5 tabs: Company Profile, Risk Register, Risk Heatmap, Treatment Plan, Executive Summary).
• GitHub repository: grc-risk-assessment (README.md, .xlsx file, Company-Profile file, Executive-Summary file).

Keep everything running

No action needed. Choose this if you plan to continue refining your risk assessment, adding more risks, or using this as a living portfolio piece.

• Your Google Sheets workbook stays in your Google Drive at no cost.
• Your GitHub repository remains publicly accessible for hiring managers to review.

Pause - I'll come back to this later

Both Google Sheets and GitHub are free to keep indefinitely. There is nothing to pause or shut down for this project.

• If you want to hide your GitHub repository temporarily, go to your repository page, click Settings, scroll to the Danger Zone section, and click Change visibility to make it private.
• Your Google Sheets workbook will remain in your Google Drive. No action needed.

Delete - I don't want to use this again

Remove all project resources completely. Only do this if you are sure you do not want to reference this work again.

• Delete the Google Sheets workbook: open Google Drive, right-click the "NovaTech Risk Assessment" spreadsheet, and select Move to trash.
• Delete the GitHub repository: go to https://github.com/YOUR-USERNAME/grc-risk-assessment, click Settings, scroll to the Danger Zone section, and click Delete this repository. Confirm by typing the repository name when prompted.

Bookmark your Google Sheets link

Even if you keep the exported files on GitHub, bookmark the original Google Sheets URL. The live spreadsheet is easier to edit if you want to update scores or add new risks later. The exported files on GitHub are snapshots of a point in time.

Nice Work!

Nice Work!

Nice work! You just built a complete cybersecurity risk assessment package for a fictional SaaS company and published it as a portfolio artifact on GitHub.

You've learned how to:

• Build a risk register with 10 identified cybersecurity risks scored using a qualitative 5x5 likelihood/impact matrix, demonstrating both inherent and residual risk.
• Create a risk treatment plan with prioritized remediation actions, responsible parties, and realistic timelines.
• Publish a portfolio-ready risk assessment package on GitHub with an executive summary that communicates technical risk findings to non-technical leadership.
• Secret Mission: Mapped all risks to NIST CSF 2.0 Functions and Categories, demonstrating cross-framework alignment skills.

Ready to quiz yourself?