Module 4 · Risk

Module 3 built Scaldimet's socle: a baseline of controls that covers most of ordinary, sector-typical risk, satisfies the law and gives the customer its certificate. That was necessary work, and it was not enough. A baseline is general by design. It cannot know that Scaldimet has an unsupported French SCADA reachable through one specific contractor's unmonitored connection, feeding a line whose three-day stoppage breaches the very contract the compliance work protected. That risk is specific to Scaldimet, and finding it is the job of this Module.

There is a picture that captures the whole idea, and it comes from ANSSI's EBIOS Risk Manager method: the digital risk management pyramid. The wide base is the compliance approach, the hygiene and the regulatory baseline that efficiently handle the broad spectrum of common attacks. That is the socle, and it is done. The narrow apex is the scenario approach: the targeted, deliberate, well-resourced attacks that a generic baseline never anticipates, which you reach only by thinking like an attacker about this organisation. ANSSI's own phrase for the method is a "synthesis between compliance and scenarios", and that is exactly the seam between Modules 3 and 4.

The main method in this Module is scenario-based assessment in the style of EBIOS RM: model what matters (business values and the assets that support them), identify who would come for it and what they fear you losing, build the strategic and operational attack scenarios, evaluate them, and decide treatment. Alongside the deep method, you will learn a lighter macro assessment as a complement, a fast top-down triage for when you need a rough picture quickly or have to decide where the deep work is worth doing.

The relationship with Module 3 becomes operational in this Module. The action plans you build when treating risk (the bespoke controls the scenarios reveal you need) link directly back to the applied controls catalogue you created in Module 3. Risk and compliance therefore use the same control environment: the controls exist because of risk, and the risk is treated by controls.

A word on a distinction this Module finally settles, introduced back in Lesson 1.3 and revisited in Lesson 6.2: inherent versus residual risk, in its formal and operational readings. Because Scaldimet's socle is already in place, the course uses the operational reading throughout, and Chapter 4.6 explains exactly what that means and why.

What this Module is, and is not

This Module borrows EBIOS Risk Manager's structure and way of thinking to teach how scenario-based risk assessment works. It is not a course on running EBIOS RM: it does not walk through the method's five workshops as a procedure, its formal deliverables or its notation, and it simplifies wherever teaching is clearer than strict method. If you need the method itself the authoritative resources are ANSSI, which publishes the method, and the Club EBIOS, which maintains and supports it. What you learn here is the reasoning; those are where you learn the method.

What you will be able to do

• Position EBIOS RM against ISO 27005 and NIST RMF, and run a fast macro assessment as a complement.
• Model business values and supporting assets at a granularity that maps to controls.
• Identify risk sources and feared events, and build strategic and operational attack scenarios.
• Build and critique a risk matrix, evaluate risk, and see the limits of qualitative scoring.
• Decide risk treatment, link action plans to applied controls, and maintain a risk register.
• Assess your suppliers and respond when you are assessed as one, and connect cyber risk to business continuity.

Chapters in this Module

Chapter	Title	Lessons
4.1	Choosing a risk method	2
4.2	Assets and business values	1
4.3	Risk sources and feared events	1
4.4	Scenario-based assessment	2
4.5	Evaluating risk	2
4.6	Risk treatment and decision	1
4.7	The risk register	1
4.8	Third-party risk	2
4.9	Cyber risk and business continuity	1
4.10	Capstone: A second risk, end to end	1

---

Begin Chapter 4.1 →