Information Security Scoring

Security risk scoring runs on three tiers, not two. The impact of a security risk is itself computed — from confidentiality, integrity and availability — before it meets the probability.

The five scoring lists

List	Token	Asks
Probability	[P]	How often is the threat expected to act?
Impact — confidentiality	[IC]	What would disclosure cost?
Impact — integrity	[II]	What would corruption cost?
Impact — availability	[IA]	What would an outage cost?
Risk value	—	The bands the final number lands in.

Three impact lists rather than one, because ISO 27001 scores the three attributes independently — and because the words an organization writes against the same number differ on each.

The shipped scales

Probability

Value	Level	Means
1	Very low	Less than once in three years
2	Low	Once a year
3	Medium	Once every six months
4	High	Once a month
5	Very high	Weekly or more often

Impact on confidentiality

Value	Level	Means
1	Very low	No disclosure impact
2	Low	A limited number of people learn of it
3	Medium	It spreads inside the organization
4	High	It leaves the organization
5	Very high	It becomes public and carries a legal sanction

Impact on integrity

Value	Level	Means
1	Very low	Corruption goes unnoticed
2	Low	A small error, easily corrected
3	Medium	Correcting it takes effort
4	High	It leads to a wrong decision
5	Very high	Irreversible data loss

Impact on availability

Value	Level	Means
1	Very low	The outage goes unnoticed
2	Low	A short outage
3	Medium	Half a day of outage
4	High	More than one day of outage
5	Very high	Operations stop

tip

The three impact scales are where a register earns its credibility. Write each one in the units that attribute is actually judged in — people who learn of it, effort to correct, hours of outage — rather than reusing one set of adjectives three times.

The three formula tiers

Tier	Produces	Shipped expression
Impact score	[IS]	MAX([IC]:[II]:[IA])
Risk score	[RS]	[IS]*[P]
Risk value	The band number	IF([RS]>=15:4:IF([RS]>=10:3:IF([RS]>=5:2:1)))

The shipped chain takes the worst of the three impacts, multiplies it by the probability for a 1–25 range, and bands that at 5, 10 and 15.

Which tokens each tier may use

Token	Is	Usable in
[IC] [II] [IA]	The three impact weights	Impact score, risk value
[P]	The probability weight	Risk score, risk value
[IS]	The impact score's output	Risk score, risk value
[AV]	The asset value from the risk's asset link	Risk score only
[RS]	The risk score's output	Risk value

The restriction runs one way. A band may read the tiers beneath it — forcing the top band from a severe enough impact whatever the arithmetic came to is a common requirement — but a score expression may not name the output it exists to produce. That is refused when the formula is saved, not left to fail against a record that happens to exercise it.

The asset value token

[AV] is the asset value carried by the risk's asset link, and it exists only where the link goes through Asset Risk. It is therefore:

• offered only where Asset Risk is installed, and
• if a risk score formula uses it, the link types that cannot supply it are withdrawn from the risk form.

note

The token is filtered from the palette rather than removed from the vocabulary. The same installation can gain Asset Risk later, and the token has to come back.

One active formula per tier

Each tier has exactly one active formula. Activating one stands the previous one of that tier down.

A tier with no active formula falls back to manual entry — somebody types the number.

The alternatives that ship inactive:

Code	Name	Tier	Expression
BFM00004	Multiplicative Impact Score	Impact	[IC]*[II]*[IA]
BFM00005	Asset Valued Risk Score	Risk score	[IS]*[P]*[AV]
BFM00006	Asset Valued Risk Value	Band	IF([RS]>=180:4:IF([RS]>=60:3:IF([RS]>=20:2:1)))

caution

The three tiers are activated independently and nothing pairs them.

Activate the multiplicative impact score — range 1 to 125 — while leaving the standard band thresholds at 5, 10 and 15, and nearly every risk will band as Critical. No error appears anywhere.

The asset-valued pair is a matched set: BFM00005 with BFM00006. If you activate one, activate the other.

The bands

Band	Name	Colour	Covers	Acceptable	Requires measure	Requires acceptance approval
1	Low	green	Below 5	Yes	—	—
2	Medium	yellow	5 to 9	—	—	—
3	High	orange	10 to 14	—	Yes	Yes
4	Critical	red	15 and above	—	Yes	Yes

Three flags on a band definition drive behaviour rather than reporting:

• Acceptable — the residual risk is within appetite.
• Requires measure — a measure must be opened before the risk can proceed.
• Requires acceptance approval — the residual risk has to be formally accepted, on the record, with a justification. This is the evidence an ISO 27001 auditor asks for.

note

The acceptance-approval flag is copied onto the record when it is scored, not read from the band afterwards. Editing a band definition later cannot change the flow of a record that has already closed.

Scores are stored, not recomputed

All three tiers are evaluated on the server on every save and written onto the record — for the initial pass and then for the residual one.

Two things follow:

• A formula edited afterwards does not move a closed record's score or its flow.
• Nothing is rescored once the risk is in force or closed. Without that guard, merely deactivating a risk would re-evaluate it against whatever the formulas say today — and could refuse the move outright with a band that no longer exists.

Where the scoring panels sit

The scoring panel reads answered first, computed second: the three impact dimensions, then the probability, then the impact score, the risk score and the band.

The computed figures are deliberately not interleaved with the answers. A server-computed number in the middle of the row somebody is filling in reads as a field they forgot.

Scoring on a revision

A new round opens with the scores where the previous round ended — its residual pass where it has one, its initial pass otherwise.

Not blank, and not the previous round's opening scores either. The risk as it stands today is what a new assessment is measured against.