Your Cyber Risk Is Rated Low. What Was Actually Tested?

Imagine a leadership team preparing to expand an online customer service. The cyber risk report is reassuring: backups are working, staff use stronger login checks, and the hosting supplier has provided a security report. The overall rating is “low”.

That sounds like a reasonable basis for moving ahead. But one assumption deserves a closer look: if the service is disrupted, can it restart quickly enough to avoid an unacceptable impact on customers and revenue?

The team has seen a successful test of restoring selected files. It has not yet seen the complete customer service restored. The distinction matters because the investment decision depends on customers being able to use the service, not simply on files being available.

This is an illustrative example, but the leadership question is practical: what does the evidence behind the rating allow us to rely on? Asking it helps people understand the conclusion and direct attention to anything that could materially affect the decision.

The same reasoning applies elsewhere. A supplier’s security report is useful when it covers the service you use. Stronger login checks are useful when the protection also holds during account recovery. The important question is whether the evidence covers the way your business actually operates.

Keep the boundary of any check beside its conclusion. A result about one application should not become reassurance about every system and process supporting customer operations.

In our example, the team might proceed because customers have a proven alternative route, make a recovery demonstration a condition of expansion, or accept the uncertainty with a named owner and an agreed review point. The appropriate choice depends on the consequences and the organisation’s willingness to accept them.

Evidence also needs to remain relevant. If the expanded service adds a new supplier, changes how staff gain access, or places greater demands on recovery, revisit the assumptions behind the earlier result. A recent date alone does not make a test relevant to a changed business.

Start by asking what existing evidence already answers. If further work is needed, agree the business outcome, who and what must be involved, and what would count as an acceptable result. Plan practical testing so its boundaries and operational precautions are understood.

This keeps the request focused. It also helps avoid spending money on a broad exercise that produces more information without resolving the question holding up the decision.