Lessons · Cybersecurity · likelihood times impact
Likelihood times impact
On a 5 by 5 matrix each risk gets a likelihood from 1 to 5 and an impact from 1 to 5, and the score is the two multiplied, which orders the risks against each other.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
A risk register with forty entries and no scores is forty arguments. With scores it is a sorted list, and the meeting is about the top five instead of about everything at once.
How to think about it
Use written definitions for each number so two people rate the same risk the same way. Multiply for the score, 1 to 25. Then read the band: 1 to 4 low, 5 to 9 medium, 10 to 14 high, 15 to 25 critical. Controls move the likelihood far more often than they move the impact.
Worked example
Risk: ransomware on the file serverNamed as an event, not as a feeling.
Likelihood 4 (expected this year), impact 5 (the business stops)Both from the definitions table.
Score = 4 * 5 = 20, which is criticalThe top band, and the top of the list.
With offline backups the likelihood of loss drops to 2: 2 * 5 = 10The impact did not change; the chance of suffering it did.
Your turn
Likelihood 3, impact 5. Write the line that gives the risk score.
risk = 3 *
Solve one, graded on the server
The trap
Rating everything 5 for impact because it feels serious. If nothing is low, the list cannot be sorted, and an unsorted list is the same as no list.