How Do You Conduct a Risk Analysis Under NIS2?

Conducting a risk analysis under NIS2 means assigning probability, consequence, and impact values to every risk you identified in the previous step. Article 21 requires essential and important entities to manage these risks through a structured risk assessment, moving from identification to analysis and finally evaluation before choosing a treatment option.

What Do You Need Before Starting a NIS2 Risk Analysis?

You need a completed risk identification step first: a documented list of threats, vulnerabilities, and the assets they could affect. NIS2 article 21(2i) requires asset management as part of this foundation, since weaknesses that threats exploit are found specifically in your organization's assets.

The book frames this as the starting point of a three-step risk assessment process. As the NIS2 Navigator's Handbook states, "A risk assessment consists of three steps: risk identification, risk analysis, and risk evaluation" (Benda, section 4.3.2). Skipping identification leaves you with no reliable list of risks to analyze, and no asset inventory to anchor the analysis to.

How Do You Identify the Risks You Need to Analyze?

Risk identification means listing every threat that could exploit a weakness in your organization, regardless of how small or significant the resulting event seems. This step relies heavily on asset management, since vulnerabilities are tied to specific systems, data, and processes you own or operate.

For NIS2 purposes, the threats you identify are focused specifically on cyber threats, while the weaknesses sit in your organization's assets — from servers and applications to the people who operate them. Without a reliable asset inventory, this step turns into guesswork rather than a structured input for analysis.

What Are the Five Elements You Must Determine for Each Risk?

For every risk you analyze under NIS2, you determine five elements: the threat itself, the vulnerability it exploits, the probability of occurrence, the consequences of a successful attack, and the resulting magnitude of impact. Together these factors turn a vague risk into a measurable value you can compare and prioritize.

Probability itself is built up from three components: the chance that you face a given threat at all, the chance that a threat actor is motivated enough to attack you, and the chance that the attack succeeds in exploiting a vulnerability. The consequences, from a cybersecurity angle, usually come down to a breach of confidentiality, integrity, or availability.

Should You Use a Qualitative, Quantitative, or Semi-Qualitative Method?

Most organizations choose a semi-qualitative method, which scores risks on a numbered scale — typically four or five levels — where each level corresponds to a defined range of financial loss or recovery time. It is faster than a quantitative analysis and more consistent than the vague high-medium-low labels of a qualitative approach.

The table below illustrates how a semi-qualitative scale of five levels might translate financial loss and recovery time into a single comparable score. This is only a sample scale; your organization sets its own thresholds based on its size and risk appetite.

How Do You Score and Evaluate the Risks You've Analyzed?

You evaluate risks by combining the values from the analysis step into a single score, most commonly calculated as impact multiplied by likelihood. This score lets you prioritize risks and compare them against your organization's risk appetite, tolerance, and capacity before deciding how to respond.

This is also where a business impact analysis (BIA) adds value, because it looks specifically at how disruption to a given process grows more severe the longer it continues. Factors such as financial loss, reputational damage, and compliance exposure all feed into the final score you assign to each risk.

How Do You Choose the Right Risk Treatment Option?

You choose among four basic treatment options the book describes: accept the risk if it falls within your appetite, avoid it by stopping the activity, transfer it through insurance or outsourcing, or mitigate it with your own controls. Many organizations combine transfer and mitigation for a balanced response.

As the handbook puts it: "Based on the results of the risk assessment, a form of treatment can be chosen by the organization. There are four basic treatment options: Accept the risk… Avoid the risk… Transfer the risk… Mitigate the risk…" (Benda, section 4.3.3). Because NIS2 article 20(1) requires top management to stay in control of cybersecurity decisions, risk acceptance in particular should be confirmed at that level rather than left to a single analyst.

One formula, three steps

Every risk you analyze under NIS2 moves through identification, analysis, and evaluation before you decide whether to accept, avoid, transfer, or mitigate it.