Keep Your Business Running When Technology Fails With IT Risk Mitigation

A cyber risk assessment focuses on security: the threats most likely to reach your data, how likely they are and what they would cost. IT risk mitigation is broader and more hands-on. It covers everyday failures as well as security, including aging equipment, single points of failure and dependence on one person or vendor, and it includes putting the fixes in place. If security is your main concern, a cyber risk assessment is the better starting point.

Any one thing that would stop work if it failed: one server that runs your main application, one internet connection, one firewall, one person who knows how a critical system is set up or one vendor that hosts it. Every business has some. The goal isn't to remove all of them, which would be costly, but to know where they are and add a fallback where an outage would hurt most.

Each risk is ranked by how likely it is to happen and how much disruption it would cause. A failing server that runs your whole business comes before a printer that's out of warranty. BCA walks you through the ranking and the cost of each fix, so you can decide what to do now and what to plan for later.

Not usually. Many of the biggest improvements cost little: documenting how systems are set up, making sure more than one person has admin access, testing backups or reviewing how a vendor contract renews. Where new equipment is the right answer, such as a second internet connection, BCA explains the cost and the benefit before you commit.

They overlap. Business continuity planning is about keeping the whole business operating through a disruption, including people, premises and processes. IT risk mitigation focuses on the technology side: reducing the chance that systems fail and making sure there's a fallback when they do. The work done here feeds directly into a continuity plan.

Once a year is a good baseline, plus whenever something significant changes, such as a new office, a key employee leaving, a new system or a change of vendor. Risks shift as the business grows, so a review that was accurate two years ago may miss the ones that matter today.