How to run a two hour security risk assessment workshop

A two hour risk workshop works when you prepare scales and a draft scenario list beforehand, invite business owners as well as security staff, rate scenarios in a fixed time box each, and leave with owners and next steps recorded. Without preparation, it turns into a debate about definitions.

Before the session

1. Define scope. One product, one business process or one environment. NIST SP 800-30 starts the assessment with preparation, where purpose, scope, assumptions, constraints and the method are settled.
2. Write the scales. Likelihood and impact levels with examples from your business. Circulate them in advance.
3. Draft scenarios. Ten to fifteen, written as one sentence each with a threat, a weakness, an asset and a consequence.
4. Collect evidence. Incident history, recent audit findings, scan summaries and architecture diagrams.
5. Invite the right people. An owner for each asset in scope, someone from engineering, someone from operations, and security as facilitator.

Agenda

• 0:00 to 0:10, frame. State the scope, the scales and how outputs will be used. Remind people that the goal is a ranked list with owners, not a perfect score.
• 0:10 to 0:20, calibrate. Rate two familiar past events together to align on meaning.
• 0:20 to 1:20, rate scenarios. Give each one about five minutes. Read it aloud. Each person writes likelihood and impact before discussing. Record the rating and a one sentence reason.
• 1:20 to 1:40, add what is missing. Ask what scenarios nobody wrote. Capture them for later rating.
• 1:40 to 2:00, decide. For the top five, propose a response and an owner. Assign follow ups.

Facilitation tips

• Write first, talk second. It reduces anchoring on the loudest voice.
• Park long debates. If two people disagree for more than two minutes, note the question and the evidence needed, then move on.
• Ask for the reason. "Why high?" produces the annotation NIST says increases repeatability of qualitative ratings.
• Keep it about scenarios. Redirect talk about specific tools or findings back to consequences.
• Time box ruthlessly. Better to rate twelve scenarios roughly than five perfectly.

Outputs

By the end you should have:

• A rated list of scenarios, with reasons.
• Owners for the top risks.
• Proposed treatments and dates.
• Open questions with a named person each.
• A date for the next review.

Send the register update within two working days while memory is fresh.

After the workshop

Check a few ratings with evidence. Challenge items where the group agreed too easily. Share the summary with participants and with the people who approve acceptance, and schedule the follow up for top risks within the quarter.

Quick check

Sources

• NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

Last reviewed: 19 October 2026.