Chapter 4.1 · Choosing a risk method¶
Two Lessons. The first explains why you need a method, introduces the EBIOS RM that divides baseline risk from bespoke risk, and positions the three methods you will hear named (ISO 27005, NIST RMF, EBIOS RM). The second teaches the lighter macro assessment that complements the deep scenario method: a fast top-down triage.
Objectives¶
- Explain the EBIOS RM pyramid and why scenario work sits on top of the socle.
- Position EBIOS RM against ISO 27005 and NIST RMF.
- Run a fast macro risk assessment to triage where the deep work is worth doing.
Lessons¶
| Lesson | Title | Time |
|---|---|---|
| 4.1.A | Why frameworks, and the EBIOS RM pyramid | ~50 min |
| 4.1.B | High-level (macro) risk assessment | ~45 min |
The Chapter quiz is at the end of Lesson 4.1.B.