vaayaa Inclusive Education
Technical risk assessment

IT Service Management Risk Assessment: Access, Continuity, Change and Data Controls

A worked example of how an IT service team finds, scores and controls the risks that threaten access, service availability, data and recovery, from identity compromise and malware to failed changes and supplier exposure.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the IT Service Management course

Executive summary

This assessment shows how an IT service team can find, rate and control the risks that matter most to access, availability, data and recovery. Eight risks were chosen because they are plausible in everyday service work. Identity compromise, malware and major outages carry the highest scores before controls. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once the added controls are in place, but major outage stays at High because recovery is hard to make fast. The first actions are multi-factor sign in, a tested restore of key file shares, a rollback rule for changes and a recovery rehearsal for core services. The organization is a teaching example, so every score illustrates method rather than describing a real service.

Focus area
IT service management and operations
Setting
Internal IT service desk and operations team supporting a mid-sized organization with cloud and on-premises services
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the IT service management function, including the service desk, incident, request, problem and change processes, service continuity, access management, logging and the handling of personal and business data held in supported services. It looks at risks to confidentiality, integrity, availability and legal duties. It does not cover the detailed design of any real network or product. Jurisdiction, size, hosting model and tooling are assumptions made for teaching.

Context

The team has a service desk manager, two service owners, a small operations group, a change advisory function and an IT security lead who works across the service. Core services include email, file storage, a customer records application and a shared finance system, some hosted by third parties. Incidents and requests are logged in a service management tool, and changes are approved before release. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to keep services available, protect the confidentiality and integrity of data, respond quickly to incidents, meet privacy and record duties, and maintain the trust of users, customers and managers. The assets in scope are identity accounts, administrator rights, endpoints, servers and cloud resources, shared file stores, the customer records application, backups, service management records and logs. Stakeholders include service users, the service desk, service owners, the IT security lead, the data protection lead, suppliers and senior management. Each risk has one owner role, and the service desk manager reports the register to management each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 Likelihood 4, impact 4, score 16, high: H01 H03 Likelihood 4, impact 5, score 20, critical: H05
3 Possible Likelihood 3, impact 3, score 9, medium: H06 H08 Likelihood 3, impact 4, score 12, high: H07
2 Unlikely Likelihood 2, impact 5, score 10, high: H04
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H06 H08 Likelihood 2, impact 3, score 6, medium: H01 H02 H03 H04 H07 Likelihood 2, impact 4, score 8, medium: H05
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Unauthorized access and identity compromise 16 High 6 Medium IT security lead
H02 Misconfiguration and unpatched vulnerabilities 12 High 6 Medium Operations manager
H03 Phishing, malware and ransomware 16 High 6 Medium IT security lead
H04 Insider misuse and privileged error 10 High 6 Medium Service desk manager
H05 Major service outage and failed recovery 20 Critical 8 Medium Service owner for core services
H06 Uncontrolled change causing incidents 9 Medium 4 Low Change manager
H07 Third-party and cloud supplier exposure 12 High 6 Medium Supplier relationship manager
H08 Privacy duties and logging gaps 9 Medium 4 Low Data protection lead
H01

Unauthorized access and identity compromise

Technology and data Before 16 After 6

Stolen or guessed credentials, or standing administrator rights that are never reviewed, let an outsider or former employee sign in to email, file stores or the customer records application.

Who or what is affected: Service users, customers and administrators

Causes

Password reuse, phishing, leavers whose accounts stay active and broad administrator rights.

Consequences

Data theft, unauthorized changes, service misuse and a loss of customer trust.

Existing controls

  • Users sign in with individual accounts and a password policy applies.
  • Administrator accounts are separate from everyday user accounts.

Control gaps

Leaver accounts are removed only when a manager remembers to ask, and admin rights are rarely reviewed.

Additional controls

  • Prevent: Require multi-factor sign in for all staff and remove standing administrator rights in favor of time-limited elevation.
  • Detect: Review sign in logs for impossible travel, repeated failures and dormant accounts each week.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: IT security lead Target: Within 30 days Early warning: A dormant or leaver account that shows a successful sign in.
H02

Misconfiguration and unpatched vulnerabilities

Technology and data Before 12 After 6

Default settings, open ports, unpatched software and inconsistent builds leave services exposed to known weaknesses that could be used by an attacker or cause failures.

Who or what is affected: Service users, operations staff and data owners

Causes

Rushed deployments, legacy systems and no owner for older services.

Consequences

Compromise, data exposure, outages and a failed audit of controls.

Existing controls

  • Operating systems receive monthly updates on managed devices.
  • A standard build is used for new servers.

Control gaps

Scans cover managed servers but not cloud resources or older systems.

Additional controls

  • Prevent: Apply a hardened baseline to every server and cloud resource and block changes that drift from it.
  • Detect: Run an authenticated configuration scan each month and track unresolved findings by age.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Operations manager Target: Within 60 days Early warning: A critical finding that remains open for more than 30 days.
H03

Phishing, malware and ransomware

Technology and data Before 16 After 6

A convincing message or infected attachment delivers malware that encrypts files or steals credentials, spreading across shared drives and disrupting every service that depends on them.

Who or what is affected: All staff, customers and file owners

Causes

Untrained users, unpatched browsers and file shares open to too many accounts.

Consequences

Encrypted records, lost work, extended downtime and a ransom or reporting duty.

Existing controls

  • Email filtering blocks known malicious attachments.
  • Endpoint protection runs on all managed laptops.

Control gaps

Restore tests are informal, and shared drives grant access to more users than needed.

Additional controls

  • Prevent: Restrict macros and executable attachments and block access to shared drives from unmanaged devices.
  • Respond: Isolate infected devices at once and follow a written containment routine.
  • Recover: Keep offline backups and test a full restore of key file shares each quarter.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: IT security lead Target: Within 30 days Early warning: A spike in quarantined attachments or in mass file renaming on a share.
H04

Insider misuse and privileged error

People Before 10 After 6

A staff member or contractor with legitimate access reads records without need, alters data, or makes a privileged change that damages a service, whether by intent or by mistake.

Who or what is affected: Customers, colleagues and service owners

Causes

Broad roles, shared accounts and pressure to clear backlogs quickly.

Consequences

Privacy breach, data corruption, disciplinary action and loss of trust.

Existing controls

  • Acceptable use terms are signed when staff join.
  • Access to customer records is granted by role.

Control gaps

Bulk exports are not flagged, and shared accounts remain in use for some tasks.

Additional controls

  • Prevent: Separate duties so that the person who requests a privileged change cannot also approve it.
  • Detect: Review access to sensitive records each quarter and alert on bulk exports.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Service desk manager Target: Within 60 days Early warning: Large exports or record views outside a person's normal work pattern.
H05

Major service outage and failed recovery

Operational Before 20 After 8

A power, hardware or software failure stops a core service, and recovery takes far longer than agreed because backups are incomplete, dependencies are unknown or the recovery steps were never tested.

Who or what is affected: All service users, customers and service owners

Causes

Single points of failure, aging hardware and unclear dependencies between systems.

Consequences

Lost productivity, missed deadlines, customer complaints and financial loss.

Existing controls

  • Core services are backed up nightly.
  • An on-call rota covers service hours.

Control gaps

Recovery steps are written down but have not been tested end to end.

Additional controls

  • Prevent: Map service dependencies and remove single points of failure for the top three services.
  • Respond: Activate a major incident team and publish updates on a fixed schedule.
  • Recover: Rehearse a full service recovery each year against a stated recovery time objective.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Service owner for core services Target: Within 90 days Early warning: A backup job that fails or a restore test that exceeds its time target.
H06

Uncontrolled change causing incidents

Operational Before 9 After 4

Changes released without impact assessment, testing or a rollback plan introduce faults, break integrations or remove security settings, creating incidents that could have been avoided.

Who or what is affected: Service users, service desk staff and change owners

Causes

Urgent fixes that bypass review, incomplete test environments and poor records of past changes.

Consequences

Repeated incidents, unplanned downtime and loss of confidence in the service desk.

Existing controls

  • Changes above a set risk level need approval.
  • A change calendar is shared with the service desk.

Control gaps

Emergency changes are approved after release and are not reviewed later.

Additional controls

  • Prevent: Require a documented rollback plan and a test result before any change above the standard level is approved.
  • Detect: Link each incident to recent changes and review the links in a weekly problem meeting.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Change manager Target: Within 45 days Early warning: Incidents within 24 hours of a change, or emergency changes above a monthly limit.
H07

Third-party and cloud supplier exposure

Supplier Before 12 After 6

A hosting, software or support provider suffers an outage, breach or contract failure, so services and data the organization depends on become unavailable or exposed without warning.

Who or what is affected: Service users, customers and contract owners

Causes

Reliance on a few providers, unclear data locations and contracts with weak exit terms.

Consequences

Service loss, data exposure, contract disputes and reputational harm.

Existing controls

  • Key suppliers are listed in a register with contract owners.
  • Contracts include service level targets.

Control gaps

Supplier evidence is collected at signing only and is not reviewed later.

Additional controls

  • Prevent: Check each supplier's security and resilience evidence before renewal and record the result.
  • Respond: Keep a documented exit and alternative supplier plan for each critical service.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Supplier relationship manager Target: Within 60 days Early warning: A supplier incident notice or a missed service level target in two consecutive months.
H08

Privacy duties and logging gaps

Legal and compliance Before 9 After 4

Personal data is kept longer than needed, access is not logged in enough detail, and incidents are not recorded in a way that shows what happened, so legal duties cannot be met.

Who or what is affected: Customers, staff and the data protection lead

Causes

Old records kept by habit, logs that are not forwarded and unclear ownership of retention rules.

Consequences

Regulator questions, weak evidence after an incident and penalties under applicable rules.

Existing controls

  • A retention schedule exists for customer records.
  • Authentication events are logged by the main identity service.

Control gaps

Logs from some applications are not collected, and retention is not enforced in practice.

Additional controls

  • Prevent: Apply automatic deletion for records past their retention period and review the schedule each year.
  • Detect: Confirm that logs from key services reach a central store and test a sample against an incident record.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Data protection lead Target: Within 90 days Early warning: A key service that has sent no logs to the central store for 24 hours.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and it must never be higher than the inherent score. Impact is judged on service downtime, data exposure, cost to correct, legal consequences and harm to trust. A risk is never rated down only because it has not happened yet. Critical and High items need senior attention and a dated plan, Medium items need routine controls with a named owner, and Low items are accepted and watched. Owners and peers should challenge every rating, and any rating is reviewed when a monitoring indicator reaches its escalation point or when a major incident, change or supplier event occurs.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Dormant or leaver accounts that record a successful sign in.Escalate to the IT security lead at once, and disable the account within one working day.
Critical configuration or patch findings open for more than 30 days.Escalate to the operations manager at 30 days, and to the service desk manager if still open after 60 days.
Incidents recorded within 24 hours of a change.Escalate to the change manager after three such incidents in one month, and pause affected change types until reviewed.
Backup or restore test results that miss the stated time target.Escalate to the service owner for core services at once, and to senior management if a restore is not proven within 30 days.
Supplier service level misses in two consecutive months.Escalate to the supplier relationship manager, and activate the exit plan if the miss continues for a third month.

Contingency arrangements

If a serious event occurs, such as confirmed ransomware, a data exposure or a core service outage beyond its target time, the major incident team takes charge. The security lead isolates affected accounts and devices, and the operations manager restores services from the latest tested backup. The data protection lead decides whether any notice duty applies, under the rules that apply in the relevant jurisdiction. Suppliers are contacted through their named contract owners, and users are told early and plainly what is affected and what to do.

Prioritized action plan

  1. Enforce multi-factor sign in and remove standing administrator rights, owner IT security lead, within 30 days.
  2. Test a full restore of key file shares and keep offline backups, owner operations manager, within 30 days.
  3. Require a documented rollback plan for changes above the standard level, owner change manager, within 45 days.
  4. Map dependencies for the top three services and rehearse their recovery, owner service owner for core services, within 90 days.
  5. Review key suppliers against evidence and exit plans, owner supplier relationship manager, within 60 days.

Conclusion

Reliable IT services depend on a few steady habits: strong identity checks, hardened configurations, tested backups, disciplined change control, managed suppliers and complete logs. The highest scores sit with identity, malware and outage risks, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified security, privacy and legal advice for any real obligation or incident.

Assumptions and limitations

Assumptions

  • The organization uses a service management tool that records incidents, requests, problems and changes with timestamps.
  • Services are a mix of cloud-hosted and internally managed systems, and some suppliers hold personal data on the organization's behalf.
  • Jurisdiction is not specified, so legal duties are described in general terms only and specialist review is needed for any real obligation.

Limitations

  • The scores are examples for learning and do not describe any real service, system or incident.
  • Security, privacy and resilience practice changes quickly, so this register must be refreshed against current guidance.
  • This is educational content and does not replace a formal site-specific risk assessment or advice from licensed security, legal or privacy professionals.

Related frameworks to study

  • Service lifecycle practices for incident, request, problem and change management
  • Least privilege and role-based access control
  • Defense in depth with layered technical and procedural controls
  • Three lines model of risk ownership
  • Hierarchy of controls

Technical Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

IT Service Management course Read the best practices for this course

More Technical risk assessments

Hourly Active: 35,661 Learners