vaayaa Inclusive Education
Technical risk assessment

Systems and Network Administration Risk Assessment: Access, Configuration and Recovery Risks

A worked example of how an administration team finds, scores and controls the risks to servers, network devices, backups and data, from privileged access and misconfiguration to malware, third parties and weak logging.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Systems and Network Administration course

Executive summary

This assessment shows how a systems and network administration team can find, rate and control the risks that matter most to the confidentiality, integrity and availability of its systems and data. Eight risks were chosen because they are plausible in everyday administration work. Privileged account compromise, weak backups and misconfiguration carry the highest inherent scores because they can affect many systems at once. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once controls such as multi-factor sign in, tested restores and standard configuration templates are in place. The first actions are securing administrator access, testing a full restore and forwarding logs to one store. The organization in this example is a teaching case, so every score illustrates method rather than describing a real network.

Focus area
Systems and network administration
Setting
Internal IT operations of a small to mid-sized organization running on-premises servers, cloud services, and a main office network with two branch sites
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the day to day work of a systems and network administration team: user and privileged accounts, servers, network devices, backups, patching, logging and vendor support. It looks at risks to the confidentiality, integrity and availability of systems and data. It does not describe a real organization, a specific product or a formal security audit. Jurisdiction, data types, hardware and vendors are assumptions made for teaching.

Context

The team manages a directory service, file and application servers, virtual machines, firewalls, switches and wireless access points across the main office and two branches. Some services run in a cloud platform managed through a provider portal, and a managed service provider handles after hours monitoring. Staff use laptops and mobile devices, and remote access is provided through a virtual private network. Each hazard is scored before controls to show its natural level, then again after the existing controls and the added controls that should be in place.

Objectives, assets and stakeholders

The objective is to keep systems available, data accurate and private, and changes controlled, so that users and clients can rely on the services the team runs. The assets in scope are directory accounts and privileged credentials, servers and virtual machines, firewalls and switches, wireless access points, backup storage, customer and staff records, logs and the documented configuration of each system. Stakeholders include the administration team, system owners, business managers, users at each site, clients whose data is held, the managed service provider and any regulator where legal duties apply. Clear roles matter: every risk has one owner role, and the systems administration lead reports the register to management each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 H04 Likelihood 4, impact 4, score 16, high: H01 H03 Likelihood 4, impact 5, score 20, critical: H06
3 Possible Likelihood 3, impact 3, score 9, medium: H08 Likelihood 3, impact 4, score 12, high: H05 H07
2 Unlikely
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H04
2 Unlikely Likelihood 2, impact 2, score 4, low: H02 H08 Likelihood 2, impact 3, score 6, medium: H01 H03 H05 H07 Likelihood 2, impact 4, score 8, medium: H06
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Privileged account compromise and identity misuse 16 High 6 Medium Identity and access lead
H02 Firewall and network misconfiguration 12 High 4 Low Network engineer
H03 Unpatched vulnerabilities on servers and endpoints 16 High 6 Medium Systems administrator
H04 Phishing and malware infection 12 High 6 Medium Security operations lead
H05 Insider misuse and accidental data exposure 12 High 6 Medium Data protection lead
H06 Backup failure and extended service outage 20 Critical 8 Medium Backup and recovery lead
H07 Third-party and managed service provider exposure 12 High 6 Medium Vendor management lead
H08 Logging gaps and slow incident response 9 Medium 4 Low Security operations lead
H01

Privileged account compromise and identity misuse

Technology and data Before 16 After 6

An attacker or careless user gains administrator rights through stolen, reused or shared credentials, then changes settings, creates hidden accounts or reads protected data across several systems.

Who or what is affected: Administrators, users and data owners

Causes

Phishing, password reuse, shared administrator accounts and rights granted and never removed.

Consequences

Data theft, altered configurations, locked out users and a costly rebuild of trust in the directory.

Existing controls

  • Administrator accounts are separate from daily user accounts.
  • Passwords must meet a length rule and are changed after a reset.

Control gaps

Privileged access is not reviewed on a set cycle, and shared logins remain on some older devices.

Additional controls

  • Prevent: Require multi-factor sign in for all administrator and remote access, and store privileged passwords in a managed vault.
  • Detect: Alert on new administrator accounts, failed privileged sign ins and logins from unusual locations.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Identity and access lead Target: Within 30 days Early warning: A new administrator account or privileged sign in outside working hours.
H02

Firewall and network misconfiguration

Technology and data Before 12 After 4

A rule is opened too widely, a default password is left on a device, or a VLAN is wired to the wrong segment, so traffic reaches systems it should never touch or a service becomes unreachable.

Who or what is affected: Network users, branch sites and server owners

Causes

Rushed changes, copied rules with no review, default settings and diagrams that are out of date.

Consequences

Exposed services, outages on a branch site and wider attacker reach after a single compromise.

Existing controls

  • Firewall rule changes are logged by the device.
  • Network diagrams are kept for the main office.

Control gaps

Rules are not reviewed for need, and branch device settings are changed without a record.

Additional controls

  • Prevent: Use a standard configuration template for each device type and require peer review before any rule change goes live.
  • Detect: Run a monthly configuration comparison against the template and report drift to the network lead.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Network engineer Target: Within 45 days Early warning: A firewall rule allowing any source to reach an internal administration port.
H03

Unpatched vulnerabilities on servers and endpoints

Technology and data Before 16 After 6

Operating systems, applications and firmware are left without security updates, so known weaknesses remain open long enough for an attacker or malware to use them against servers and client devices.

Who or what is affected: Server owners, staff using endpoints and customers of hosted services

Causes

Fear of downtime, legacy applications that resist updates and no owner for some devices.

Consequences

Compromised servers, data loss, forced emergency work and service interruption.

Existing controls

  • Servers receive monthly update windows.
  • A list of installed software is kept for the main servers.

Control gaps

Branch devices and older appliances sit outside the scanning routine, so their gaps go unseen.

Additional controls

  • Prevent: Set a patch deadline by severity and test updates on a staging system before production.
  • Detect: Scan servers and endpoints each week for missing updates and report those past deadline.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Systems administrator Target: Within 30 days Early warning: A server more than 30 days past a high severity patch deadline.
H04

Phishing and malware infection

Technology and data Before 12 After 6

A user opens a malicious attachment or link, or a document carries code that spreads across shared folders and file servers, encrypting or stealing data and disrupting the network.

Who or what is affected: All staff, file server owners and clients whose data is held

Causes

Convincing lures, staff under time pressure and shared drives open to many accounts.

Consequences

Encrypted files, stolen credentials, downtime and a costly clean up.

Existing controls

  • Endpoint protection runs on all managed laptops.
  • Email attachments with executable types are blocked.

Control gaps

Shared drives allow write access to many users, and personal devices reach file shares without checks.

Additional controls

  • Prevent: Filter email links and attachments, and run phishing awareness exercises at least twice a year.
  • Respond: Isolate an infected device from the network at once and follow a written step list for containment.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Security operations lead Target: Within 60 days Early warning: A spike in reports of suspicious email or unusual file encryption activity on a share.
H05

Insider misuse and accidental data exposure

People Before 12 After 6

A staff member with access copies, shares or deletes data without need, either by mistake or with intent, such as sending a customer file to a personal account or leaving a backup on an unsecured drive.

Who or what is affected: Data subjects, colleagues and the organization

Causes

Excess access, weak training, time pressure and unclear rules on sharing.

Consequences

Privacy harm, complaints, disciplinary action and loss of client trust.

Existing controls

  • Staff sign an acceptable use agreement when they join.
  • Access to customer folders is limited to named groups.

Control gaps

Access reviews are done only when staff change roles, and bulk export is not logged.

Additional controls

  • Prevent: Block removable storage on administrator and finance devices and restrict bulk export of records.
  • Detect: Review access logs for large downloads or unusual sharing each month and record the outcome.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Data protection lead Target: Within 60 days Early warning: A single user downloads or shares more records in one day than their usual pattern.
H06

Backup failure and extended service outage

Operational Before 20 After 8

Backups are incomplete, corrupted or stored where the same event can destroy them, so after a fault or attack the team cannot restore key services within the time the business needs.

Who or what is affected: All users, service owners and customers

Causes

Unverified backup jobs, shared backup logins and storage in the same room as the servers.

Consequences

Long outage, lost records, missed deadlines and heavy cost to the business.

Existing controls

  • Nightly backups run for the file and directory servers.
  • Backup jobs send a status email to the team.

Control gaps

Restores have not been tested end to end, and some application servers are not in the backup scope.

Additional controls

  • Recover: Test a full restore of one critical service each quarter and record the time taken.
  • Prevent: Keep one copy offline or in a separate location and protect backup credentials with separate accounts.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Backup and recovery lead Target: Within 30 days Early warning: A backup job that fails or reports success with missing data for two runs in a row.
H07

Third-party and managed service provider exposure

Supplier Before 12 After 6

A vendor or managed service provider with administrative access to systems is breached, makes an error during maintenance, or fails to deliver support, so the organization loses control of its own services.

Who or what is affected: Service owners, end users and the vendor relationship team

Causes

Standing vendor accounts, unclear responsibility for patching and limited oversight of contractor staff.

Consequences

Unauthorized changes, data exposure, slow recovery and dependence on one supplier.

Existing controls

  • Vendor accounts are created only after a written request.
  • Support contracts list response times.

Control gaps

Vendor sessions are not recorded, and contract reviews do not check security duties.

Additional controls

  • Prevent: Limit vendor access to named systems, with time bound accounts and recorded sessions.
  • Respond: Hold a written exit and continuity plan for each critical vendor and test it yearly.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Vendor management lead Target: Within 60 days Early warning: A vendor account used outside the agreed maintenance window.
H08

Logging gaps and slow incident response

Legal and compliance Before 9 After 4

Logs are not kept, are overwritten too soon or are not reviewed, so an incident cannot be traced, reported on time or explained to those who need to know, and privacy duties may be missed.

Who or what is affected: Affected individuals, management and regulators where they apply

Causes

Small log volumes that are not sized, no owner for review and unclear rules on notification.

Consequences

Missed deadlines, weak evidence, repeated incidents and penalties where rules apply.

Existing controls

  • Core servers send system logs to a central store.
  • An incident contact list is kept by the service desk.

Control gaps

Network device logs are kept locally and are often overwritten before anyone looks at them.

Additional controls

  • Detect: Forward sign in, privilege and firewall logs to one store and review alerts each working day.
  • Respond: Practice a short incident drill twice a year that covers notification steps and evidence handling.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Security operations lead Target: Within 45 days Early warning: A log source that has not sent events for more than 24 hours.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. A Critical rating means the risk must be treated before any other work on that system continues. High means a dated plan with senior sign off, Medium means routine controls with a named owner, and Low means the risk is accepted and watched. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls. Impact is judged on service downtime, data loss, privacy harm, cost to repair and damage to trust, and a technical risk is never rated down only because it has not yet happened. Ratings are challenged in three ways: the owner explains the basis for each score, a peer from another team tests the controls described, and the register is reviewed whenever a warning indicator reaches its threshold or a major change to systems or vendors is made. Specialist review is needed for any real security, privacy or resilience decision.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
New administrator accounts or privileged sign ins outside working hours.Escalate to the identity and access lead at once, and to the security operations lead if the account cannot be explained within one working day.
Firewall rules that allow any source to reach an internal administration port.Escalate to the network engineer at once and remove the rule within 24 hours unless a documented need is approved by the systems owner.
Servers more than 30 days past a high severity patch deadline.Escalate to the systems administrator, and to the head of infrastructure if the gap remains open after 14 days.
Backup jobs that fail, or report success with missing data, two runs in a row.Escalate to the backup and recovery lead at once, and to management if no successful restore has been tested within the quarter.
Vendor accounts used outside the agreed maintenance window.Escalate to the vendor management lead immediately, suspend the account and inform the systems owner within the same day.

Contingency arrangements

If a serious event occurs, such as a confirmed account compromise, ransomware on a share or a failed core service, the on call administrator isolates affected systems and preserves logs. The security lead informs the systems owner and the business continuity contact at once. Restores are made from the most recent tested backup, and access is reissued only after the cause is closed. Legal, privacy and regulator contacts are made through the data protection lead where required. Staff and clients are told what they need to know early and in plain language.

Prioritized action plan

  1. Require multi-factor sign in and a managed vault for all privileged accounts, owner identity and access lead, within 30 days.
  2. Perform a full restore test of one critical service and keep one backup copy offline, owner backup and recovery lead, within 30 days.
  3. Patch servers by severity deadline and scan weekly for missing updates, owner systems administrator, within 30 days.
  4. Forward sign in, privilege and firewall logs to one central store with daily review, owner security operations lead, within 45 days.
  5. Limit vendor access to named systems with time bound and recorded sessions, owner vendor management lead, within 60 days.

Conclusion

Reliable systems and networks depend on a few steady habits: separate and protected privileged access, standard configurations with peer review, timely patching, tested restores and logs that someone reads. The highest scores sit with privileged access, backup and malware risk, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real legal, privacy or security question.

Assumptions and limitations

Assumptions

  • The organization has an assigned owner for each system, and changes go through a recorded approval step.
  • Data includes personal and business records, and the jurisdiction is not specified, so legal duties are described in general terms only.
  • Vendors and hardware are typical of small to mid-sized sites and are not named in this example.

Limitations

  • The scores are examples for learning and do not describe any real network, system or incident.
  • Security, privacy and resilience practice changes over time and differs by country, so specialist review is needed before any real decision.
  • This is educational content and does not replace a formal site-specific assessment or advice from a licensed security professional.

Related frameworks to study

  • Least privilege principle
  • Defense in depth
  • Hierarchy of controls
  • Three lines model of risk ownership
  • Incident response lifecycle
  • Backup copy rule of several copies on different media and locations

Technical Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Systems and Network Administration course Read the best practices for this course

More Technical risk assessments

Hourly Active: 35,186 Learners