Scoring List Definitions
Five lists feed information security scoring — one probability, three impact dimensions, and the risk value bands. Each is its own screen with its own permissions and its own number template.
| Screen | Token | Holds |
|---|---|---|
| Probability | [P] | How often the threat is expected to act |
| Impact — confidentiality | [IC] | What disclosure would cost |
| Impact — integrity | [II] | What corruption would cost |
| Impact — availability | [IA] | What an outage would cost |
| Risk value | — | The bands the final score lands in |
Why three impact lists rather than one
ISO 27001 scores confidentiality, integrity and availability independently, and an organization writes
different words against the same number on each. A 4 on confidentiality means information left the
organization; a 4 on availability means an outage of more than a day. One list carrying both would have to
be described in language vague enough to cover them, which is precisely what makes a scale unusable.
The four scored lists
Probability and the three impact dimensions share one shape:
- Code — issued from that list's own number template when left empty.
- Name — the level as a person reads it.
- Value — the weight the formulas read. This is the field that matters.
- Description — what the level means in practice, ideally as an observable test.
- Active — inactive levels are no longer offered when scoring.
No two levels within one list may carry the same value. A 3 in probability and a 3 in impact-integrity
are unrelated and do not collide.
See Scoring for the shipped level texts on all four.
Write each impact scale in the units that attribute is really judged in — people who learn of it, effort to correct, hours of outage. The shipped scales do this, and it is what stops two assessors scoring the same scenario two levels apart.
The risk value band list
The band list defines the levels a scored risk is finally reported as, and its rows carry different fields:
- Code / Name —
Low,Medium,High,Critical. - Band number — what the risk value formula has to return to land here.
- Colour — how the band is drawn in the register and on the record.
- Acceptable — the residual risk is within appetite.
- Requires measure — a measure must be opened before the risk can proceed.
- Requires acceptance approval — the residual risk must be formally accepted, with a justification.
- Description — conventionally the score range this band covers.
- Active — inactive bands are not offered.
The three flags are behaviour, not labels
| Flag | What it does |
|---|---|
| Acceptable | Reporting: marks the band as within risk appetite. |
| Requires measure | Makes the risk wait for measures before it can proceed. |
| Requires acceptance approval | Routes the risk through the acceptance approval step, where the justification an auditor asks for is recorded. |
On the shipped bands, High and Critical carry both of the last two.
Requires acceptance approval is the flag that produces your audit evidence. A residual risk above appetite that was signed off rather than treated further needs a stated justification, and the acceptance approval step is the only place that field exists.
If your High and Critical bands do not carry the flag, those risks go straight into force with no recorded acceptance — which is exactly the gap an ISO 27001 audit looks for.
The flags are copied onto the record when it is scored, not read from the band at the time of the move. Editing a band definition later cannot reroute a record that has already closed.
The band number is the only join
The risk value formula returns a number, and the band that applies is the one whose band number equals it.
- No two bands may declare the same band number.
- Every number the active formula can return needs a band, or scoring a risk that lands there fails with a message rather than saving without a level.
Five lists, five sets of permissions
Each screen is permissioned separately, and the separation is deliberate: being allowed to edit the probability list does not imply being allowed to edit the band definitions.
A dimension level decides what one number means. The bands decide what the whole register reports, and whether a risk needs formal acceptance — which is a different kind of authority.
Excel import and export
Each list has its own import template, named after the list and carrying only that list's columns — the band template has the flags and the colour, the scored templates have the value. A row naming a different list is refused, and the rest of the file still loads.
Leave the code column blank and the code is issued from that list's own number template, which is also what keeps the five counters and prefixes apart.
Bulk delete refuses the whole selection if any row is named by an open risk.
Changing a live scale
Adding a level is safe. Changing an existing level's value, or a band's boundaries or flags, does not re-score anything — every score, band and flag is stored on the record as it was saved.
Applying a scale change to existing risks means opening a revision per risk.
Settle all five lists and all three formula tiers before the first risk is opened. This module has three tiers rather than two, so there is more to get consistent — and the cost of a late change is a revision per risk in the register.