LiveRisk: How to Assess Your Organisation's Cybersecurity Risks (FREE Assessment)

Most small organisations know they should be doing more about security. The harder question is where to start. LiveRisk exists to answer that.

LiveRisk is our free online self-assessment. You answer 25 questions about how your organisation runs today, and at the end you get a risk score and a risk rating. It takes about 15 to 20 minutes.

It's built for small New Zealand organisations, particularly professional service practices such as accounting firms, law practices and medical and dental clinics. These are businesses with valuable client data and rarely a dedicated security person.

What LiveRisk asks organisations

The questions cover your organisation's profile, how security is managed, staff training, data handling, systems and devices, incident response, suppliers and your obligations under the Privacy Act 2020.

Each question has a short set of answers to choose from. You don't need to look anything up first. If you don't know an answer, pick the closest option and make a note of it. Not knowing whether your backups work is a finding in its own right.

What is a risk rating?

Every answer you give is rated on a four-level scale.

• Low: This area is in good shape. Keep it that way.
• Medium: Acceptable, with room to improve. Plan for it.
• High: A significant weakness. Deal with it soon.
• Critical: An urgent exposure. Deal with it first.

Some ratings reflect who you are rather than what you do. Sector, size and revenue are rated too. An accounting or legal practice starts with a higher rating on sector alone, because those firms hold exactly the data attackers go after and carry heavier regulatory obligations. That rating says nothing about how well you run things. It tells you the stakes are higher.

Your overall risk rating places your organisation in one of these bands based on all 25 answers.

What is a risk score?

Behind each rating sits a number, from 1 for Low to 4 for Critical. Your risk score brings those numbers together across all 25 questions. The higher the score, the more exposed you are.

In this assessment there's no pass mark as two organisations can land on similar scores with very different problems. One might have a dozen small gaps. The other might be in decent shape apart from untested backups and no plan for an incident. The second one is in more trouble.

It is important to read the individual ratings, not just the headline number.

Why it matters

Small organisations get targeted for the same reasons large ones do. They hold client money, personal records and financial details. They usually have less standing between that data and a convincing phishing email.

Under the Privacy Act 2020, a serious privacy breach has to be reported to the Privacy Commissioner and the people affected. That's a bad time to discover what you should have had in place.

A risk rating turns a vague sense of unease into a list you can work through. Prioritising "security" can feel daunting, but prioritising "test our backups" and "write down who we call when something goes wrong" are small steps an organisation can take to be better prepared.

Where LiveRisk fits

If you don't know where to start, start here. LiveRisk is written for organisations without a security team. The questions use plain language, and nothing assumes technical knowledge.

As a conversation prompt with your team

This is probably its best use. Complete it together: a partner or practice manager, whoever looks after IT and your IT provider if you have one.

Expect some disagreement, because that's useful. If the practice manager thinks backups run daily and the IT provider says weekly, you've found a gap before you've finished the assessment.

Is LiveRisk an audit?

No. Nobody checks your answers against evidence, and the questions aren't mapped to a formal standard. That is deliberate. LiveRisk is a self-assessment tool that tells you where to look first.

If you need evidence, our full Security Maturity Assessment provides it. You’d need that if a client, insurer or government contract asks for assurance. It covers six security domains, maps to the NZISM and the Protective Security Requirements, and tests what’s in place. LiveRisk tells you whether that step is worth taking and where to point it.

Should I complete it before contacting Liverton Security?

Completing a LiveRisk assessment helps, but isn't required. If you've done it, we can start further along because we can see where you think your gaps are. If you haven't, we'll often work through it with you in the first conversation.

Next steps

What to do with your LiveRisk results:

• Start with your Critical answers. Skip the ones based on sector or size, because you can't change those. Focus on the ones you can act on.
• Move on to your High answers and plan them into the next three months.
• Go through the results with your IT provider. Some fixes will be quick for them and slow for you.
• Retake the assessment in six to twelve months and compare.
• Talk to us about anything you can't fix internally.

» What's my risk score and rating? LiveRisk is our FREE online self-assessment, designed to help organisations start conversations about cybersecurity. Answer 25 questions to assess your cyber risk and see your risk score and rating.

Need help improving your cybersecurity?

Liverton Security helps organisations identify security gaps, assess risks and strengthen their security practices. Whether you're working through your LiveRisk results or need help deciding what to tackle next, our team can help you understand your options.