Abstract: A method and system for risk assessment. A question set including one or more questions may be transmitted. Each question may be based on statutory, sectoral or standards requirements relating to how an entity handles information, and each question may be associated with one or more categories. An answer set may be received including one or more selected answers. Each selected answer may correspond to a question in the transmitted question set and each selected answer may be associated with a risk score. The risk score may be related to the statutory, sectoral or standards requirements. An assessment based on the answer set may be generated and transmitted. The assessment may include one or more questions and corresponding answers organized by risk score and category. A request for remediation action may be generated and transmitted when an answer corresponding to a question is associated with a risk score above a threshold risk score.