| Title | Description | Likelihood | Impact | Score | Mitigations |
| Cyber attack | A cyber attack, such as a DDOS attack, brings down systems we provide to customers. | 4 | 5 | 20 | Security software including DDOS protection, monitoring systems, redundant hosting, penetration testing, incident response planning, Cyber Essentials certification, and staff training. |
| Data breach | Personal data we process becomes available outside of the organisation. | 3 | 5 | 15 | GDPR compliance, encryption, security software, data protection policies, and staff training. |
| External Service Disruption | Issues affecting our access to the internet or online services. | 4 | 5 | 20 | Remote working, alternative service provisions, and staff training. |
| Insider threat | A staff member maliciously or accidentally causes issues with systems or data | 1 | 5 | 5 | Monitoring systems including activity logging, principle of least privilege, and staff training. |
| Legacy systems | Systems become outdated presenting a cyber security risk due to lack of security updates or updates not being applied. | 3 | 3 | 9 | Regular minor version updates, monitoring for major version updates, using LTS versions, and staff training. |
| Misconfiguration of software | Software is misconfigured exposing data or resulting in issues with systems we provide. | 2 | 3 | 6 | Monitoring systems, penetration testing, and staff training. |
| Phishing & Social Engineering | Staff members are tricked into taking actions that expose access to systems or data to threat actors. | 3 | 5 | 15 | Email filters, checking organisational memberships, and staff training. |
| Ransomware attack | Threat actors are able to encrypt data or systems, removing our ability to access to them. | 3 | 4 | 12 | Security software, monitoring systems, regular backups, and staff training. |
| Supply Chain Vulnerability | Third party vendors cease to exist or introduce vulnerabilities to software we make use of. | 4 | 3 | 12 | Regular version updates, monitoring for vulnerabilities, and staff training. |
| | | /5 | /5 | /25 | |