SOC 2 risk assessment
Updated
List the risks that follow from your stack, rate likelihood and impact on the scales your own Risk Assessment and Management Policy defines, choose a treatment for each, and watch the heat map fill in. Then download a Word report and an Excel register to complete and approve. Built in your browser from your generator answers, or from the sample company.
This is the sample company, Northwind Cloud Inc. The risk list and the method come from its answers and its Risk Assessment and Management Policy, not yours. Answer the generator questions (in your browser) and come back: the list then follows your hosting, identity provider, device management, data types, vendors, headcount and report scope.
Heat map
| Impact | 1Rare | 2Unlikely | 3Possible | 4Likely | 5Almost certain |
|---|---|---|---|---|---|
| 5 Severe | · | · | · | · | · |
| 4 Major | · | · | · | · | · |
| 3 Moderate | · | · | · | · | · |
| 2 Minor | · | · | · | · | · |
| 1 Negligible | · | · | · | · | · |
Likelihood across, impact down. Numbers are risks per cell.
Summary
0 of 17 risks rated.
- Critical (15-25)0 inherent, 0 residual
- High (10-14)0 inherent, 0 residual
- Moderate (5-9)0 inherent, 0 residual
- Low (1-4)0 inherent, 0 residual
Download the draft
A Word report (scope, the method quoted from the sample policy, heat maps, the risk register, the treatment plan, acceptance forms and approval lines) and an Excel worksheet whose scores, ratings, heat map and sign-off flags are formulas. Anything you have not entered stays a [Fill in] placeholder. Built in your browser; nothing is uploaded.
Your entries are kept in this page’s address (after the #), so you can bookmark the page or send the link. The link includes any names and notes you type.
Rate each risk
Likelihood and impact use the 5-point scales in section 2 of the sample Risk Assessment and Management Policy. Rate the inherent risk as if the controls you rely on were not there, then the residual risk that remains with them. Open a risk to rate it.
RISK-001An employee account is taken over through phishing or a reused password.Inherent: not rated
Affected assets: Okta, email, GitHub
Existing controls: P04 Authentication: MFA enforced; P02 Acceptable Use; P18 security training
Criteria: CC6.1, CC6.2.
RISK-002Customer data is exposed through misconfigured cloud storage, network rules or IAM.Inherent: not rated
Affected assets: Northwind infrastructure on AWS, Vercel
Existing controls: P20 Network and Infrastructure; P11 weekly cloud posture review; P08 encryption
Criteria: CC6.1, CC6.6, CC7.1.
RISK-003A vulnerable dependency or code flaw in Northwind is exploited.Inherent: not rated
Affected assets: Northwind application and its dependencies
Existing controls: P10 Secure Development; P11 scanning and remediation timelines
Criteria: CC7.1, CC8.1.
RISK-004An unreviewed or faulty change reaches production.Inherent: not rated
Affected assets: GitHub, GitHub Actions, production
Existing controls: P09 Change Management: branch protection, required review and checks
Criteria: CC8.1.
RISK-005Production data is lost or corrupted and cannot be restored.Inherent: not rated
Affected assets: Production databases and storage
Existing controls: P15 Backup and Recovery (AWS Backup); restore tests
Criteria: CC7.5, A1.2.
RISK-006A prolonged outage of AWS, Vercel or a region takes Northwind down.Inherent: not rated
Affected assets: Northwind availability
Existing controls: P14 Business Continuity and Disaster Recovery; recovery objectives and tests
Criteria: CC9.1, A1.2.
RISK-007A vendor holding customer data (Supabase, Stripe, Datadog, Slack) suffers a breach or failure.Inherent: not rated
Affected assets: Customer data held by vendors
Existing controls: P16 Vendor Risk: tiering, SOC 2 review, contract terms
Criteria: CC9.2.
RISK-008A former employee or contractor keeps access after leaving.Inherent: not rated
Affected assets: Okta, GitHub, cloud consoles, SaaS tools
Existing controls: P03 Access Control quarterly review; P18 offboarding checklist
Criteria: CC6.2, CC6.3.
RISK-009A laptop with company data is lost, stolen or left unpatched.Inherent: not rated
Affected assets: Endpoints
Existing controls: P19 Endpoint Security (Kandji): disk encryption, screen lock, updates
Criteria: CC6.8.
RISK-010A security incident is not detected, or the response is slow or uncoordinated.Inherent: not rated
Affected assets: Northwind and corporate systems
Existing controls: P12 Logging and Monitoring (Datadog); P13 Incident Response
Criteria: CC7.2, CC7.3, CC7.4.
RISK-011Personal data in Northwind is used, kept or shared beyond what customers and the privacy notice allow, or a data subject request is missed.Inherent: not ratedFrom your answers
Affected assets: Personal data of customers and their users
Existing controls: P22 Privacy and Data Protection; P07 Data Retention and Disposal; P06 Data Classification
Your answers say the product handles personal data (PII). Criteria: CC3.2, CC6.1.
RISK-012Security settings drift between AWS and Vercel because each platform is configured and monitored separately.Inherent: not ratedFrom your answers
Affected assets: Northwind infrastructure on AWS and Vercel
Existing controls: P20 Network and Infrastructure; P11 cloud posture review; P12 Logging and Monitoring
Your answers list 2 hosting providers. Criteria: CC6.6, CC7.1.
RISK-013A vendor (Supabase, Stripe, Datadog and Slack) is given customer data or production access, or changes its service, without a security review or contract terms.Inherent: not ratedFrom your answers
Affected assets: Customer data and access held by vendors
Existing controls: P16 Vendor Risk: review before onboarding, annual review of Tier 1 vendors, contract security terms
Your answers name 4 vendors. Criteria: CC9.2.
RISK-014Capacity or performance limits make Northwind miss the availability commitments made to customers.Inherent: not ratedFrom your answers
Affected assets: Northwind availability and its service commitments
Existing controls: P14 Business Continuity; P12 Logging and Monitoring (capacity alerts)
Availability is in your report scope. Criteria: A1.1.
RISK-015Recovery takes longer than the recovery time objective because restores and failover were never tested end to end.Inherent: not ratedFrom your answers
Affected assets: Northwind recovery
Existing controls: P14 Business Continuity (recovery objectives and tests); P15 Backup and Recovery (AWS Backup)
Availability is in your report scope. Criteria: A1.2, A1.3.
RISK-016Someone with privileged access misuses it, or alters financial or customer records, and the change is not noticed.Inherent: not ratedRequired by the policy
Affected assets: Northwind production data, billing and finance systems, admin consoles
Existing controls: P03 Access Control (least privilege, review of admin roles); P12 Logging and Monitoring (audit logs); P09 Change Management (review of changes)
P17 section 4.2 asks every assessment to consider fraud, misuse of privileged access and manipulation of records. Criteria: CC3.3.
RISK-017A significant change (new product feature, infrastructure, vendor, market or team change) goes ahead without its risks being assessed.Inherent: not ratedRequired by the policy
Affected assets: Northwind and the company's objectives
Existing controls: P17 triggered assessments; P09 Change Management; P16 Vendor Risk (onboarding review)
P17 section 4.1 names the changes that trigger an assessment. Criteria: CC3.4.
How to run the assessment
- Book a workshop with the people who own your systems, vendors and people processes, and the person who will approve the result.
- Go through the list. Mark risks that do not apply, with a reason, and add the ones only you know about.
- For each risk, agree inherent likelihood and impact on the policy’s scales, then the residual rating with today’s controls.
- Choose a treatment with one owner, the planned controls and a due date. Accept a risk only with a written reason.
- Download the report, replace every [Fill in] placeholder, and collect the approval and acceptance signatures the policy requires.
- Track the treatment actions in your ticketing system and review the highest-rated risks each quarter.
Where the method comes from
Nothing in the scoring is fixed by this page. The scales, the rating bands, who may accept each rating and how long an acceptance lasts are read from section 2 and section 4 of the Risk Assessment and Management Policy as rendered for your company, and the report quotes each rule with its section number. If you change the policy, the wizard and the report follow it. For the sample company the policy uses a 5 by 5 grid:
| Rating | Score | Required response | Who may accept it |
|---|---|---|---|
| Critical | 15 to 25 | Treatment plan within 5 business days; treatment started within 30 days; acceptance only by Executive Management | Executive Management |
| High | 10 to 14 | Treatment plan within 30 days; treated or accepted within 90 days | the Security Owner with a member of Executive Management |
| Moderate | 5 to 9 | Treatment plan within 90 days; reviewed each quarter | the Security Owner |
| Low | 1 to 4 | Monitored; treated when practical or accepted by the system owner | the system owner |
On cadence, the policy says (P17 section 4.1): “Northwind Cloud Inc conducts a formal risk assessment at least annually and after triggers including a SEV1 or SEV2 incident, a significant change to Northwind or its infrastructure, adoption or loss of a Tier 1 vendor, entry into a new market or regulatory regime, a material organizational change, or a failed control test; triggered assessments may be limited to the affected area.”
What auditors look for
A risk assessment report is evidence that the process in your policy ran; it does not show that controls operate. What an auditor asks for depends on the firm and on what your policy commits to. Things that may be requested:
- A dated risk assessment inside the examination period, run at the cadence your own policy states, with the people and scope it names.
- Approval of the assessment, the risk appetite and any accepted risks by the people your policy names, with signatures and dates.
- Scores on the scales your policy defines, applied consistently, with inherent and residual ratings for each risk.
- A link from each risk to the controls and policies that treat it, so the control set can be shown to follow from the assessed risks.
- Fraud risks (CC3.3) and changes that affect risk (CC3.4) considered, not only external attackers.
- Vendor and business disruption risks (CC9.1, CC9.2), and treatment actions with owners and due dates followed through to closure.
Three points to have ready:
- Cadence. The assessment happens as often as your policy says, and inside the period the report covers. An annual assessment dated before the period starts may not count for it.
- Approval. Executive Management signs the assessment and the risk appetite, and each accepted risk carries the signature of the authority your policy names for its rating.
- Linkage to controls. Each risk names the policies and controls that treat it, and each treatment action has an owner and a due date, so the control set traces back to the assessed risks.
The Trust Services criteria the record relates to:
- CC3.1 Objectives for risk assessment: objectives are clear enough to assess risks against; the scope and objectives in the report show this.
- CC3.2 Identifying and analyzing risks: risks are identified and analyzed: a dated register with scores, owners and treatment decisions.
- CC3.3 Fraud risk: fraud is considered, which is why the list includes misuse of privileged access and altered records.
- CC3.4 Changes that affect risk: changes that affect risk are assessed: new vendors, infrastructure, markets, incidents.
- CC9.1 Mitigating business disruption risk: business disruption risks are identified and mitigated, such as a hosting outage or a key person leaving.
- CC9.2 Vendor and business partner risk: vendor and business partner risks are assessed and managed.
Related templates
- Risk register template: the blank Excel register with starter risks, for a generic stack.
- Risk Assessment and Management Policy: the policy whose scales, acceptance authorities and cadence this page uses.
- Policy generator: answer the questions once and this page, the register and all 22 policies use your tools, owners and scope.
- Audit Kit: the paid kit includes the risk assessment report draft and the worksheet, built from your tailored policies, alongside the risk register.
Frequently asked questions
- Does SOC 2 require an annual risk assessment?
- SOC 2 requires a risk assessment (criteria CC3.1 to CC3.4) but the criteria do not set a frequency. Your own risk policy does, and the auditor tests against it. The Policyseed Risk Assessment and Management Policy commits to a formal assessment at least annually and after triggers such as a serious incident, a significant change or a new critical vendor, with quarterly reporting to Executive Management. For a Type II report, the assessment needs to fall inside the examination period.
- What is the difference between inherent and residual risk?
- Inherent risk is scored as if the controls you rely on were not there. Residual risk is what remains with existing controls and completed actions. The gap between the two shows which controls matter. Residual risk is what someone has to treat or accept, so acceptance authority follows the residual rating.
- Who has to approve an accepted risk?
- Whoever your policy names for the rating. In the Policyseed template, Critical risks are accepted by Executive Management; High risks are accepted by the Security Owner with a member of Executive Management; Moderate risks are accepted by the Security Owner; Low risks are accepted by the system owner (P17 section 4.5). The wizard and the report flag any risk accepted at High or above as needing Executive Management sign-off. Acceptances expire within 12 months.
- Why are the risks not rated for me?
- Because the ratings are your judgment and the auditor can ask how you reached them. The list starts every risk unrated; rate the ones that apply in a short workshop with the people who own the systems, mark the rest as not applicable with a reason, and add your own.
- How is this different from the risk register template?
- The risk register template is a blank Excel register with starter risks. This page builds the list from your generator answers, quotes the method from your own Risk Assessment and Management Policy, lets you rate and treat each risk with a live heat map, and produces the report that records the assessment and its approval, plus a worksheet with the same entries.
- Is anything uploaded?
- No. Your generator answers stay in this browser's local storage, the policies are rendered here and the Word and Excel files are built here. Ratings and notes are kept in the page address after the #, which browsers do not send to the server; anyone you send the link to can read them. Without saved answers the page shows the sample company, Northwind Cloud Inc.
Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.