Building and selecting a risk matrix¶
The matrix is simple; defining the scales is the important part.¶
Everyone recognises the risk matrix: the grid of likelihood against severity, green in one corner, red in the other. It is so familiar that people grab a pre-coloured one and start dropping risks into cells. That is backwards. The grid itself is relatively simple; the real work is in defining the scales so that "high severity" and "high likelihood" mean something specific and consistent at Scaldimet. Build the scales by hand first, exactly as this course insists for every tool, and the matrix becomes a real instrument. Adopting a risk matrix without defined scales merely translates subjective judgements into coloured cells.
First: inherit the enterprise scale, if one exists¶
Before defining anything, ask a prior question: does the organisation already have an enterprise risk management (ERM) framework in place? If it does, it already has severity and likelihood scales, and a risk appetite, used across financial, operational, strategic, legal and safety risks. Cyber risk is one category within that portfolio, not a separate risk universe. Where an enterprise scale exists, inherit it: assess cyber severity using the same bands and business-impact anchors the organisation already uses. This allows cyber risks to be presented to the board alongside other risks and compared using the same language. Creating a separate cyber-only scale makes that comparison harder.
Two adjustments are usually needed when you inherit the enterprise approach:
- Likelihood. ERM often expresses likelihood as an annual probability or event frequency. This course assesses cyber likelihood through the feasibility of the attack path (Chapter 4.4), because reliable frequency data for targeted attacks is limited. Keep feasibility as the basis of the cyber analysis, then map the result to the enterprise likelihood bands for reporting. The severity scale can usually be inherited directly; the likelihood scale requires a documented mapping between the cyber assessment and the enterprise scale.
- Size. If the enterprise matrix is 5×5, report cyber risks on the 5×5 even though this lesson uses a 4×4 to encourage clearer decisions. Consistency across the enterprise risk portfolio is more important than using a different grid for cyber risk. The key requirement is that cyber risks can be placed alongside other enterprise risks using a common scale.
If no ERM framework exists (as at Scaldimet, which does not yet have an enterprise risk framework) build the cyber scales as described below, but make them ERM-compatible: use business-outcome anchors and a structure that could later be adopted at enterprise level. When the organisation formalises enterprise risk management, the cyber scale can then be integrated into the wider framework rather than replaced.
Defining the severity scale¶
A severity scale turns the vague word "bad" into ranked, described levels, anchored in Scaldimet's business. Four levels are usually enough:
| Level | What it means at Scaldimet |
|---|---|
| Negligible (Minor) | A nuisance: minor disruption, no lasting harm, no external notice |
| Significant (Moderate) | A real but absorbable hit: limited downtime, some cost, internal effort to recover |
| Serious (Major) | Material harm: a line stoppage, an OEM penalty, a reportable incident, real money |
| Critical | Existential or safety-level: prolonged stoppage losing the OEM contract, or harm to people |
Note the anchors are business outcomes (OEM penalties, contract loss, safety), not technical descriptions. That is what lets two different people rate the same scenario the same way, which is the whole purpose of a scale.
Defining the likelihood scale¶
Likelihood needs the same treatment: named, described levels. For Scaldimet's scenarios, likelihood is the feasibility of the attack path (Chapter 4.4):
| Level | What it means at Scaldimet |
|---|---|
| Rare | No known path; an attacker would need to defeat strong controls at several stages |
| Possible | A partly-mitigated path: feasible for a determined attacker but meeting real obstacles |
| Likely | A known, largely open path: readily walked by an ordinary attacker |
| Almost certain | An open path actively exposed (for example, unmonitored remote access into a flat OT network) |
The time horizon hidden in a likelihood rating¶
Feasibility says how possible a path is, but every likelihood rating also assumes a period. "Almost certain" is trivially true over an unlimited horizon. Given enough time, any feasible path could eventually be taken. To make the rating useful for decisions, anchor it in two ways. A window: assess feasibility over the review period, usually a year, or over the relevant exposure window, such as the contract term. In that context, "almost certain" means expected within that window, not eventually. A motivated source: a path is likely to be used soon only when a capable, motivated attacker is present, based on the risk sources identified in Workshop 2. An open path with no interested attacker is feasible, but it is not necessarily imminent. Even then, the rating does not say how often per year an event will occur. That is what quantification adds, where FAIR expresses loss event frequency in events per year. Qualitative feasibility says how possible the path is; quantified frequency says how often the event is expected to occur.
Selecting the matrix¶
With scales defined, selecting the matrix is choosing the grid size and where the risk thresholds fall. A 4 by 4 (four severity levels and four likelihood levels, sixteen cells) suits Scaldimet: large enough to separate scenarios meaningfully, small enough to force decisions. Resist the temptation of a 5 by 5 or larger "for precision"; finer grids imply an accuracy the underlying judgements do not have, and they let people hide in the comfortable middle. Then decide the thresholds: which combinations are intolerable (treat now), which are tolerable only with justification, which are acceptable. Those thresholds are a statement of Scaldimet's risk appetite (Lesson 2.1), and they should be agreed with the committee, not invented by the analyst.
A serious-severity, high-likelihood scenario (Scaldimet's line-halt path) lands in the intolerable zone. That placement is not arithmetic; it is a defined scale meeting a defined threshold, which is why it is defensible to the board.
Application: define Scaldimet's scales¶
On paper, write Scaldimet's severity scale and likelihood scale with a one-line business anchor for each level, choose a matrix size and justify it in one sentence, and mark which cells are intolerable. Then place the line-halt scenario and check it lands where your scales and thresholds say it should. If you defined the scales well, the placement will produce a consistent result based on the defined scales and thresholds.
Model answer (open after you've drafted yours)
Severity (business anchors): 1 Minor — contained IT outage, no production impact · 2 Moderate — short disruption, recovered same day · 3 Major — multi-day disruption or reportable breach, a delivery at risk · 4 Critical — multi-day production stoppage or loss of customer design data, a breached OEM contract.
Likelihood: 1 Rare — no known path · 2 Possible — a partly-mitigated path · 3 Likely — a known, largely open path · 4 Almost certain — an open path actively exposed (unmonitored remote access to flat OT).
Size: 4×4 — fine enough to separate "major" from "critical" (the decision that matters for Scaldimet), coarse enough not to imply more precision than the method supports.
Intolerable cells: severity 4 with likelihood ≥ 2, and severity 3 with likelihood ≥ 3 — these encode the appetite from Lesson 2.1 and are agreed with the committee (2.4), not set by the CISO alone.
Line-halt placement: severity 4 (a stoppage breaches the OEM contract), likelihood 3–4 (unpatched OT via an unmonitored contractor) → an intolerable cell, which is why it is the lead risk. Good scales make that placement follow from them, not from a gut feeling.
Key takeaway
The risk matrix's value is not the grid but the scales: define severity in terms of Scaldimet's business outcomes (OEM penalties, contract loss, safety) and likelihood in terms of attack-path feasibility, with named, described levels so two people rate alike. Select a modest matrix (a 4 by 4 forces decisions; finer grids can create an impression of precision that the underlying judgements do not support) and set thresholds that state Scaldimet's risk appetite, agreed with the committee. Build the scales by hand first; a borrowed matrix with undefined scales can give subjective judgements an appearance of precision. The tool can plot the matrix, but only defined scales make the positions mean anything.
Next: Lesson 4.5.B · Evaluating risk and the limits of qualitative scoring →