A data risk assessment identifies what data you hold, where it lives, who can access it, which threats and weaknesses apply, and how bad and how likely each outcome would be. The result is a ranked list of risks with owners and decisions: reduce, accept, transfer or avoid.
What does NIST say a risk assessment is?
NIST SP 800-30 Rev. 1 is the standard guide for conducting risk assessments. It describes assessment as one part of an overall risk management process that gives leaders the information they need to choose a course of action. It was written for US federal systems, but the method is general.
The method has a simple shape: identify threat sources and events, identify vulnerabilities, estimate likelihood and impact, and combine them into risk. A data focused assessment applies that shape with data as the asset.
Step 1: What data do you have?
You cannot assess what you have not listed. Build a data inventory: categories (customer records, payment data, health data, source code, credentials), systems that hold each, volume and owner. Include copies in backups, logs, analytics warehouses, spreadsheets and test environments. Test copies of production data are the usual surprise.
Step 2: Where does it flow?
Trace each category from collection to deletion. Who collects it, which systems process it, which vendors receive it, where it is stored, when it is deleted. The NIST Privacy Framework is built around managing privacy risk from data processing, and its data processing viewpoint is a good prompt for this step.
Step 3: What could go wrong?
For each flow list plausible events: unauthorised access by an outsider, misuse by an insider, accidental exposure through a misconfigured store, loss of availability, and corruption. Tie events to vulnerabilities you can point to, such as a public bucket, a shared admin account, or a vendor with no deletion process.
Step 4: How do you score it?
Pick a scale and keep it. A common approach is likelihood and impact each rated low, medium or high, with a written definition for each level. For impact, think about people as well as the company: what happens to the individuals whose data it is.
A constructed example: a customer table is copied nightly to an analytics store. The store has broad read access and no masking.
- Event: an analyst's account is taken over.
- Likelihood: medium, since access is broad and multifactor sign-in is not enforced.
- Impact: high, since the table holds contact details and order history.
- Result: high risk, owner named, fix in thirty days.
Step 5: What do you do about each risk?
Choose a response. Reduce it with controls such as masking, tighter access and encryption. Avoid it by deleting the data or stopping the collection. Transfer part of it through contract or insurance. Accept it, in writing, by someone with authority. Each response gets an owner and a date.
Step 6: How do you keep it current?
Repeat when something changes: a new system, a new vendor, a new data type, an incident. NIST SP 800-137 describes continuous monitoring as ongoing awareness of assets, threats and control effectiveness, which is the right mindset. A yearly document that nobody opens does not qualify.
How to check or apply this
- Name an owner and a scope, for example one product line, and finish that before widening.
- Build the inventory and flow map in a shared spreadsheet.
- Write your likelihood and impact definitions before scoring anything.
- Score every flow, then sort and review the top ten with the owners.
- Record the decision and date for each, and track open items to closure.
- Schedule a review trigger list: new vendor, new data type, incident, major release.
Where the data is customer information inside your software, a dependency and code scan shows which libraries and services touch it. Safeguard's compliance automation can keep evidence for the controls you pick, though the decisions stay yours.
Quick check
Is a data risk assessment the same as a privacy impact assessment?
They overlap but differ in focus. A data risk assessment looks at security and business risk to data. A privacy impact assessment focuses on risk to individuals from processing, and some laws require one in specific cases.
How often should we repeat it?
On any significant change and at a fixed interval your policy sets. Continuous inputs, such as access reviews, should feed it between formal reviews.
Sources
- NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments
- NIST Privacy Framework
- NIST SP 800-137, Information Security Continuous Monitoring
Last reviewed: 18 October 2026.
