| File Reference : | RA-BR3 Information Security (Virtual Company) |
| Date File Updated | 18-06-2026 |
| File Format | MS Word |
| No. of files | 1 |
| Category | Business Risk Assessments | Tags: ISO 27001 |
Included in the alphaZ subscription
Every alphaZ document and toolkit, with updates as they are released. Everything you download is yours to keep.
With a virtual company there is no building to worry about, so the risks sit with people, their laptops and the cloud apps they log into. This example gathers them in one place, which makes putting your own assessment and risk register together much more straightforward.
This example risk assessment has been prepared using the
F-Q36 General Risk Assessment form template - a purpose-built template designed to focus entirely on what matters: identifying business risks, assessing their likelihood and impact, and recording the controls that manage them, without any unnecessary fields getting in the way.
The file is supplied in fully editable MS Word format and can be easily customised and saved to Google Docs format if required. The document uses pre-defined style formatting throughout with styles to match the risk-ratings which are input using select boxes pre-populated with all possible risk ratings. All text is in Calibri font for improved readability.
The following document labelling is included in the footer:
- Form number and title
- Information-classification
- Version
- Page number / total pages
Further guidance on information security for remote and cloud-based working:
Download this form template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.
This file is included in the alphaZ subscription.
Information Security Risk Assessment (Virtual Company)
This fully completed information security risk assessment example has been prepared by experienced ISO management system consultants. It covers information security across the cloud-based systems and data of a virtual company with no business premises, where staff work remotely, and can be used as a starting point when developing your own information security risk assessment.
What Does This Information Security Risk Assessment Cover?
This risk assessment identifies the key information security risks a virtual, cloud-based company faces, including:
- Phishing and social engineering targeting remote staff
- Malware and ransomware infection
- Passwords, account access and multi-factor authentication on cloud accounts
- Cloud storage, online services and collaboration tools
- Home and remote working environments, and the use of personal devices
- Loss or theft of devices and secure home networks
- Insider threat, third-party access and legal and regulatory compliance
A residual risk rating is then assigned to each risk, demonstrating how practical controls - such as staff awareness training, multi-factor authentication, secure cloud configuration, independent backups and device encryption - reduce the overall risk to a tolerable level.
A Professional Easy-to-Use Risk Assessment Template
This document uses colour-coded header styles matched to risk ratings, making it quick to read and easy to communicate during team briefings and staff training. A built-in risk rating matrix supports consistent evaluation of likelihood and consequence, and clear risk symbols help communicate each risk at a glance. An inherent and a residual rating are recorded for every risk, so the effect of your controls is easy to demonstrate.
Risk, Control and Prohibition Symbols
Each row in the assessment is tagged with a small symbol so the type of risk, the control that manages it and any prohibition are clear at a glance. The same icon set runs across every alphaZ business risk assessment, which keeps a finished document quick to read and easy to compare. You can read more about them in our blog post on the alphaZ business risk icons.
Who Is This Information Security Risk Assessment Suitable For?
This template is suitable for virtual and fully remote businesses that operate in the cloud and need to identify, assess and document information security risk. It is particularly useful when implementing or maintaining an information security management system aligned with ISO 27001, and when supporting the risks and opportunities requirements (clause 6.1) of ISO management system standards. Directors, managers and remote teams can all use it as a ready-made starting point.
