Risk scoring is a way to rank risks by giving each one a number based on how likely it is and how much harm it would cause.
The most common formula is simple: risk score = likelihood × impact. A risk that is likely and damaging gets a high score and gets fixed first. A risk that is rare and minor gets a low score and may simply be accepted.
Reviewed by Riya Ann Varghese, GRC Engineer, ISO 27001 lead auditor certified. Last updated October 21, 2026.
How We Wrote This Guide
We based this guide on primary sources: NIST SP 800-30 Rev. 1 (the US government's guide to risk assessment), the FIRST CVSS v4.0 specification, and the AICPA Trust Services Criteria used in SOC 2. The worked examples come from the risk assessments we help companies run for SOC 2 and ISO 27001 audits. A GRC engineer reviewed every section.
What Is Risk Scoring?
Risk scoring is the step in a risk assessment where you turn each risk into a number so you can compare and rank them.
Without scores, every risk looks equally urgent. With scores, a team can agree on what to fix this quarter, what to watch, and what to accept. A risk score is the number itself. Risk scoring is the method you use to get it.
Risk scoring is used in many fields, such as credit, fraud, and healthcare. This guide covers cyber and compliance risk, which is what SOC 2, ISO 27001, and HIPAA auditors look at.
How Do You Calculate a Risk Score?
You calculate a risk score by rating likelihood and impact on the same scale, usually 1 to 5, and multiplying them.
- Name the risk clearly. "Phishing steals an admin login" is better than "phishing".
- Rate the likelihood from 1 (rare) to 5 (almost certain), taking your current controls into account.
- Rate the impact from 1 (minor) to 5 (severe), thinking about money, customers, downtime, and legal exposure.
- Multiply them. The result is a score from 1 to 25.
- Read the band (low, medium, high, critical) and decide what to do.
Likelihood and Impact Scales
| Rating | Likelihood | Impact |
|---|---|---|
| 1 | Rare: not expected in the next 3 years | Minor: no customer impact, fixed in hours |
| 2 | Unlikely: could happen once in 2 to 3 years | Limited: small cost, a few customers affected |
| 3 | Possible: could happen once a year | Moderate: service outage or data exposure needing notice |
| 4 | Likely: expected more than once a year | Major: large customer impact, regulator interest |
| 5 | Almost certain: happening now or monthly | Severe: business-threatening loss or breach |
These definitions are a starting point. Write your own and keep them the same every time, so a "4" means the same thing to every team.
Risk Score Example
A risk score example: phishing that steals an admin login is likely (4) and major (4), so it scores 16, which is critical.
| Risk | Likelihood | Impact | Score | Level |
|---|---|---|---|---|
| Phishing steals an admin login | 4 | 4 | 16 | Critical |
| Cloud access key leaked in a code repository | 3 | 5 | 15 | Critical |
| Former employee still has access | 3 | 4 | 12 | High |
| A key vendor is breached | 2 | 5 | 10 | High |
| Laptop lost, disk encrypted | 2 | 2 | 4 | Low |
After you add a control, score the risk again. That second number is the residual risk. For example, hardware security keys for admins can lower phishing likelihood from 4 to 2, so the score drops from 16 to 8.
The 5x5 Risk Scoring Matrix
A risk scoring matrix is a grid with likelihood on one side and impact on the other, where each cell shows the score and its color band.
| Score | Level | What to do |
|---|---|---|
| 15 to 25 | Critical | Act now. Assign an owner and a fix date within weeks. Report to leadership. |
| 10 to 14 | High | Plan a fix this quarter and track it in the risk register. |
| 5 to 9 | Medium | Reduce it when practical, and review it every quarter. |
| 1 to 4 | Low | Accept and monitor. Record the decision. |
A 3x3 matrix (scores 1 to 9) is quicker for small teams. A 5x5 matrix gives more detail and is the most common choice for SOC 2 and ISO 27001 programs. Both are fine, as long as you use one consistently and write down why.
Risk Scoring Methods Compared
The main risk scoring methods are qualitative (words like low and high), semi-quantitative (number scales like 1 to 5), and quantitative (money).
Whichever you choose, write it down as your risk scoring methodology, so every team scores risks the same way.
| Method | How it scores | Best for | Watch out for |
|---|---|---|---|
| Qualitative | Low, medium, high | New programs, little data | Hard to compare risks that share a label |
| Semi-quantitative | Likelihood × impact, 1 to 25 | Most SOC 2 and ISO 27001 programs | Numbers look precise but are still judgment |
| Quantitative | Expected loss in dollars (for example, FAIR) | Budget decisions, mature teams | Needs good loss and frequency data |
A simple quantitative formula is annual loss expectancy: ALE = single loss expectancy × annual rate of occurrence. If one incident costs $50,000 and you expect it twice a year, the ALE is $100,000. Our guide to cyber risk quantification covers FAIR in more depth, and risk assessment methodologies compares the wider frameworks.
NIST, CVSS, and the 5x5 Matrix: Which Scale Is Which?
The 5x5 matrix, the NIST 0 to 100 scale, and CVSS measure different things, but their bands line up as low, medium, high, and critical.
| Scale | Range | Bands | What it scores |
|---|---|---|---|
| 5x5 risk matrix | 1 to 25 | Low 1-4, medium 5-9, high 10-14, critical 15-25 (common convention) | Any business or security risk |
| NIST SP 800-30 | 0 to 100 | Very low 0-4, low 5-20, moderate 21-79, high 80-95, very high 96-100 | Risk to an organization's operations and assets |
| CVSS v4.0 | 0.0 to 10.0 | Low 0.1-3.9, medium 4.0-6.9, high 7.0-8.9, critical 9.0-10.0 | How severe a single software vulnerability is |
A CVSS score is not a risk score. A critical vulnerability on a test server with no data may be a low risk to your business. Use CVSS to set patch deadlines, and your own matrix to rank business risks.
What Is a Cyber Risk Score?
A cyber risk score is a number that sums up how exposed a company is to cyber attacks, either from your own assessment or from an outside rating service.
There are two kinds, and they answer different questions:
- Internal cyber risk scores come from your own risk assessment. They see your controls, data, and systems from the inside.
- External security ratings come from services that scan a company from the outside, such as its websites, email settings, and leaked credentials. They are useful for checking vendors, but they cannot see internal controls like access reviews or backups.
For audits and vendor reviews, use both: external ratings to spot obvious problems fast, and your own scoring for the decisions that matter. Our vendor risk assessment matrix shows how to score vendors.
What Is a Risk Scorecard?
A risk scorecard is a one-page summary that shows your top risks, their scores, the trend since last time, and who owns each one.
Leaders do not read risk registers. They read scorecards. A good cyber risk scorecard fits on one slide and answers three questions: what is above our risk appetite, is it getting better or worse, and what decision do you need from us.
Keep the full detail in your risk register. The scorecard is the view for the board or leadership team.
How UprootSecurity Helps You Score and Track Risk
UprootSecurity keeps your risk register, scores, and treatment plans in one place, linked to the controls that reduce each risk.
- Risk management: score each risk on likelihood and impact, assign owners, and track residual risk after controls.
- Third-party risk management: assess and score vendors in the same system.
- Continuous monitoring: checks across 140+ integrations show when a control that lowers a risk stops working.
→ See how it works: book a demo
How SOC 2, ISO 27001, and HIPAA Use Risk Scores
SOC 2, ISO 27001, and HIPAA all require a documented risk assessment, and risk scoring is how most companies meet that requirement.
- SOC 2: criterion CC3.2 asks you to identify risks and estimate their significance, including the likelihood of threats and the impact on your objectives. See our guide to the trust services criteria.
- ISO 27001: clause 6.1.2 requires you to assess the consequences and likelihood of each risk, determine its level, and compare it with your risk acceptance criteria. See ISO 27001 requirements.
- HIPAA: the Security Rule requires an "accurate and thorough" risk analysis of threats to protected health information, in 45 CFR 164.308(a)(1).
Evidence Auditors Ask For
| Evidence | What the auditor checks |
|---|---|
| Risk scoring methodology | Written scales for likelihood and impact, and your score bands |
| Risk register | Every risk scored, with an owner and a treatment decision |
| Risk acceptance | Sign-off by management for risks you chose to accept |
| Treatment plans | Controls linked to each high or critical risk, with dates |
| Review records | Proof the assessment was redone at least once a year, or after a big change |
Auditors do not judge whether your score for a risk is "right". They check that you followed your own method, scored every risk, and acted on the high ones.
Common Risk Scoring Mistakes
- Scoring without definitions. If "likely" means different things to different people, the scores mean nothing.
- Ignoring existing controls. Score likelihood with the controls you have today, then show the effect of new ones as residual risk.
- Treating CVSS as business risk. Vulnerability severity is one input, not the final answer.
- Scoring once a year and forgetting. Re-score after incidents, new products, or new vendors.
- Too much precision. A score of 12 versus 13 is not a real difference. Look at the band.
How UprootSecurity Approaches Compliance
Scoring your risks is the first step. Proving you treat them, across the whole audit period, is the work that follows.
| What you need | How UprootSecurity handles it |
|---|---|
| A risk register auditors accept | Risk management with likelihood, impact, owners, and residual risk |
| Vendor risk scores | Third-party risk management in the same platform |
| Proof that controls still work | Continuous monitoring across 140+ integrations |
| Guidance for your team | A dedicated compliance expert through readiness and the audit |
| Proof for customers | A trust center and security questionnaire automation |
| A clear price | A custom quote based on your scope, with a yearly penetration test in every plan |
UprootSecurity is a compliance platform for startups and scaleups that need SOC 2, ISO 27001, HIPAA, or other frameworks. See our vendor risk product and plans.
Frequently Asked Questions
Risk scoring is a way to rank risks by giving each one a number based on how likely it is and how much harm it would cause. The most common method multiplies likelihood by impact on a 1 to 5 scale, giving a score from 1 to 25. Higher scores get fixed first, and low scores may be accepted.
Risk scoring is usually calculated by multiplying likelihood by impact. Rate how likely the risk is from 1 to 5, rate how much harm it would cause from 1 to 5, and multiply them. A risk rated 4 for likelihood and 4 for impact scores 16, which falls in the critical band on a 5x5 matrix.
The risk rating represents how serious a risk is compared with the other risks you found. It combines how likely the risk is and how much damage it would do. The rating tells you what to fix first, what to monitor, and what you can accept, and it is the basis for your risk treatment plan.
A common set of 5 risk severity levels is very low, low, moderate, high, and very high, which NIST SP 800-30 uses. Many companies use 4 levels instead: low, medium, high, and critical. The number of levels matters less than defining each one clearly and using the same levels across the whole company.
A good risk score is one that sits below your risk appetite, the level of risk leadership has agreed to accept. On a 5x5 matrix, many companies accept scores of 1 to 4 and monitor scores of 5 to 9. Anything 10 or higher usually needs a treatment plan with an owner and a deadline.
A risk scoring matrix is a grid that plots likelihood against impact, where each cell shows a score and a color band. A 5x5 matrix gives scores from 1 to 25 and is the most common choice for SOC 2 and ISO 27001 programs. A 3x3 matrix is simpler and suits small teams with few risks.
A risk score measures how much a risk matters to your business, while a CVSS score measures how severe a single software vulnerability is. CVSS runs from 0 to 10 and ignores your context. A critical CVSS vulnerability on an isolated test server can still be a low business risk after scoring.
A cyber risk score is a number that sums up how exposed a company is to cyber attacks. It can come from your own risk assessment or from an outside security rating service that scans public systems. Internal scores see your controls, while external ratings are useful for a quick check of vendors.
Yes, SOC 2 requires a risk assessment. Criteria CC3.1 to CC3.4 cover setting objectives, identifying and analyzing risks, considering fraud, and assessing changes. Auditors expect a documented method, a scored risk register, and proof that the assessment is reviewed at least once a year or after significant changes.
You should update risk scores at least once a year and whenever something important changes. Triggers include a security incident, a new product or system, a new critical vendor, or a major change in threats. Many companies review their high and critical risks every quarter and report the trend to leadership.
