Asset Risk Formulas

Two formula types turn the three security dimensions into a number and then into a band.

The two types

Type	Produces	May reference
Asset value score	The numeric asset value	[C] [I] [A]
Asset value band	The band number	[C] [I] [A] [AV]

[AV] is the resulting score. A band formula may read it; a score formula may not — it is the thing the score formula exists to produce, and the system refuses to save a score expression that names it.

A band expression may also name the three dimensions directly. That is not an oversight: forcing the top band whenever a single dimension is at its highest level is a common requirement, and it cannot be expressed from the score alone.

Fields

• Code / Name
  The formula's identity.

• Formula type
  Score or band. Set this first — it decides which tokens the editor will accept.

• Expression
  The expression itself.

• Blank value default
  What an unanswered variable is worth. Empty (the default) means the formula refuses to score while any variable it names has no value. See Blank value default below.

• Active
  Only active formulas are evaluated, and there is one active formula per type. Activating a formula stands the previous one of that type down.

The shipped formulas

Code	Name	Type	Expression	Active
VFM00001	Multiplicative Asset Value Score	Score	[C]*[I]*[A]	Yes
VFM00002	Multiplicative Asset Value Band	Band	IF([AV]>64:4:IF([AV]>27:3:IF([AV]>8:2:1)))	Yes
VFM00003	Highest Dimension Asset Value Score	Score	MAX([C]:[I]:[A])	No
VFM00004	Highest Dimension Asset Value Band	Band	IF([AV]>=5:4:IF([AV]>=4:3:IF([AV]>=3:2:1)))	No

The second pair ships inactive on purpose. It is a different scale — 1 to 5 rather than 1 to 125 — so seeding it active alongside the first pair would leave two formulas claiming one output, and activation would silently stand one of them down at install time.

caution

The two types are activated independently, and nothing checks that they match. Activate MAX([C]:[I]:[A]) while leaving the multiplicative bands in place and every asset lands in band 1, with no error anywhere — the highest score the new formula can produce is 5, and the bands do not start until 9.

If you switch one, switch both. This is the single most common way to get a register full of assets that all look Low.

Writing expressions

Expressions use spreadsheet syntax. Both IF(a:b:c) and IF(a,b,c) are accepted, and the usual functions are available: MAX, MIN, SUM, AVERAGE, ROUND and their relatives.

Tokens are written in brackets so that the F inside IF( cannot be mistaken for a variable.

Examples

A score that weights confidentiality double:

[C]*2+[I]+[A]

A band that forces Critical whenever any single dimension is at its maximum:

IF(MAX([C]:[I]:[A])>=5 : 4 : IF([AV]>64 : 4 : IF([AV]>27 : 3 : IF([AV]>8 : 2 : 1))))

Your own fields as variables

Any parametric field you have defined on the record this formula scores can be named in an expression, in brackets, exactly like the built-in variables:

[C]*[I]*[A]*[criticality_factor]

Which of your fields are eligible:

Field type	Usable in a formula
Number, Decimal	Yes
Yes / No	Yes — counts as 1 or 0
Single select	Only if every option's value is a number or a yes/no
Everything else — text, dates, files, references, multi-select	No

A select over labels is a category, and multiplying by a category means nothing however tidy the arithmetic looks. The formula editor's palette lists the eligible fields beside the built-in variables, so you do not have to remember the key.

The score shown live on the assessment screen is worked out from the same fields as the stored score, so what you see while filling the form is what gets saved. See Parametric Fields for how to define one.

Blank value default

A blank field is not zero. By default, a formula that names a field with no value refuses to score at all, and the record keeps whatever it had. That is deliberate: an empty cell would evaluate as nought, and a score of nought reads as no risk rather than not answered yet.

That default is right when every variable is compulsory, and wrong when a parametric field is genuinely optional. So each formula carries its own setting:

• Blank value default — empty (the default)
  Refuse to score while any referenced variable has no value.

• Blank value default — a number
  Every unsupplied variable evaluates as that number. Set it to 1 for a multiplier that should have no effect when unanswered, or 0 for an addend.

One number applies to all of that formula's variables; it is not set per field. Zero is a legitimate choice — leaving the setting empty is what means "no default", not entering 0.

caution

Before setting a blank value default, be sure the answer it produces is one you would defend. "Treat blanks as 1" quietly turns an unanswered exposure factor into a full-weight one.

The formula editor

The expression is not typed into a plain text box. The editor is a full page — not a modal, unlike the other definition screens — because it carries three things:

• A token palette of the variables this type may use. The palette follows the formula type field, so changing the type re-reads what may be named.
• A live check that validates the expression as you type. A refusal while typing is expected, not an error.
• A try-it panel that evaluates the expression against values you supply. For a band formula it also reports which band the result lands on — or warns you that no band declares that number.

tip

Validate at the boundaries, not in the middle. The interesting failures in a banding formula are the score that should just tip into the next band, and the dimension value that should trigger an override. A formula that behaves correctly on 3, 3, 3 tells you almost nothing.

Import and export

Formula definitions export to Excel and re-load from a filled-in template. An expression is checked on the way in exactly as it is on the form, so an expression the editor refuses cannot be stored by uploading it instead.