Section 500.9 requires a documented risk assessment of your information systems, reviewed at least annually and whenever a business or technology change materially alters cyber risk. Engineering supplies the facts: what systems exist, what data they hold, what threats apply, which controls work and what gaps remain.
This is general information, not legal advice.
What the section requires
The assessment must inform the design of the cybersecurity program. It must allow controls to be revised in response to technology and threats, and consider the entity's operations, the nonpublic information it holds, the systems it uses, and the availability and effectiveness of controls.
It must be carried out under written policies and procedures that include three things: criteria for evaluating and categorizing risks or threats, criteria for assessing confidentiality, integrity, security and availability of systems and nonpublic information including adequacy of existing controls, and requirements describing how identified risks are mitigated or accepted and how the program addresses them.
Triggers for an update outside the annual cycle
The text says whenever a change in the business or technology causes a material change to cyber risk. Examples engineers will recognize:
- A new product that stores customer records.
- A move to a new cloud provider or region.
- Adoption of AI features or tools.
- A new third party with access to nonpublic information.
- A major incident.
Add a line to your change process that asks whether the change is material to cyber risk and logs the answer.
Inputs by source
| Input | Source |
|---|---|
| Systems and owners | Asset inventory under 500.13 |
| Data sensitivity | Data classification |
| Threats | Incident history, advisories, penetration test results |
| Control effectiveness | Scan results, access review, restore test outcomes |
| Open gaps | Findings backlog with ages |
| Vendor exposure | Third party register |
A simple scoring approach
Score each risk on likelihood and impact with defined bands, record the existing controls, and then record the decision: mitigate, accept or transfer. The acceptance column matters because the rule expects risks to be mitigated or accepted by explicit choice. Acceptances should name an approver and a review date.
Keep it a living document
An annual document written in a single week tends to describe last year. Update the register when a finding closes, when an acceptance expires and when the inventory changes. By the time of the formal review most of the work is done.
Mistakes to avoid
Risk assessments weaken when they list generic threats instead of your own systems, score everything medium, or hide acceptances in meeting notes. Another gap is leaving out vendors and AI tools. Tie each risk to a named system from the inventory, use bands with definitions that force choices, record acceptances with an approver, and include third party and AI exposure.
Quick check
Is the risk assessment only for the CISO?
The CISO oversees it, but accurate inputs come from engineering, operations and vendor management.
How often must it be updated?
At a minimum annually, and whenever a change in the business or technology causes a material change to cyber risk.
Sources
Last reviewed: 19 October 2026.
