Understanding Risk Scores
Risk scoring helps organizations prioritize security investments by quantifying the likelihood and impact of threats. Inherent risk represents the risk before controls, while residual risk accounts for existing mitigations.
Key Components
- Asset Value: How critical the asset is to operations (1-10)
- Threat Likelihood: How probable a threat event is (1-10)
- Vulnerability Severity: How easily the vulnerability can be exploited (1-10)
- Existing Controls: Percentage effectiveness of current controls (0-100%)