Current risk describes the remaining exposure with today's safeguards in place. Assess what is operating and supported by evidence, including its limitations.
Explain the present state
In Current risk, write the scenario as it exists now. Use Strength, Weakness, Opportunity and Threat to explain effective safeguards, remaining gaps and adverse conditions.
For example, MFA may protect employees while a legacy service account still relies on a reusable secret. State which part of the scenario is reduced by the existing control and which exposure remains.
Link or attach evidence that supports important assumptions. A planned measure belongs in recommendations and the target assessment until it is implemented.
Place the risk on the matrix
Choose a threat/vulnerability cell in Likelihood level. That cell provides the configured likelihood level. Select Impact and the applicable Impact types, then inspect Risk exposure.
The numeric exposure equals the resulting likelihood level multiplied by the impact level. The displayed band follows the configured matrix. Treat these as decision-support scores rather than probabilities or financial values.
Save and compare
Save the assessment and compare the current result with its inherent baseline. Explain meaningful differences through the safeguards and assumptions, not simply through a lower selected cell. Keep unset values explicit when an assessment has not been completed.