# Risk Assessment Matrix Template

## Purpose

This template provides a structured approach to identifying, analyzing, and prioritizing information security risks. It enables systematic risk assessment required for E-ITS, ISO 27001, SOC 2, and other compliance frameworks.

## When to Use

- Establishing or updating an ISMS (ISO 27001)
- E-ITS compliance risk assessments
- Annual security reviews
- After significant changes (new systems, threats, incidents)
- SOC 2 risk management processes
- GDPR Data Protection Impact Assessments (related)

## How to Use

1. **Identify Risks**: List potential threats and vulnerabilities affecting your assets
2. **Assess Likelihood**: Estimate probability of occurrence (1-5 scale)
3. **Assess Impact**: Determine potential consequences (1-5 scale)
4. **Calculate Risk Level**: Likelihood × Impact = Risk Score
5. **Prioritize**: Focus on high/critical risks first
6. **Define Treatments**: Accept, mitigate, transfer, or avoid
7. **Implement Controls**: Apply security measures
8. **Monitor**: Review and update regularly

## Official References

- **ISO 27001:2022**: Clause 6.1.2 Information security risk assessment
- **E-ITS**: Riskianalüüs ja riskijuhtimine
- **SOC 2**: CC9.1 Risk assessment processes
- **NIST SP 800-30**: Guide for Conducting Risk Assessments

---

## Risk Matrix

### Likelihood Scale

| **Level** | **Description** | **Frequency** | **Score** |
|-----------|-----------------|---------------|-----------|
| **Rare** | Almost never happens | < 1% annually | 1 |
| **Unlikely** | May occur in exceptional circumstances | 1-10% annually | 2 |
| **Possible** | Could occur at some time | 10-50% annually | 3 |
| **Likely** | Will probably occur | 50-90% annually | 4 |
| **Almost Certain** | Expected to occur frequently | > 90% annually | 5 |

### Impact Scale

| **Level** | **Description** | **Consequences** | **Score** |
|-----------|-----------------|------------------|-----------|
| **Negligible** | Minimal impact, easily recovered | Minor inconvenience, < €1,000 loss | 1 |
| **Minor** | Small impact, some effort to recover | Short disruption, €1,000-€10,000 loss | 2 |
| **Moderate** | Noticeable impact, significant effort | Service degradation, €10,000-€100,000 loss | 3 |
| **Major** | Serious impact, major resources needed | Critical service down, €100,000-€1M loss | 4 |
| **Catastrophic** | Severe impact, organization survival threatened | Complete failure, > €1M loss, legal action | 5 |

### Risk Level Matrix

| Likelihood ↓ \ Impact → | **1 Negligible** | **2 Minor** | **3 Moderate** | **4 Major** | **5 Catastrophic** |
|-------------------------|------------------|-------------|----------------|-------------|--------------------|
| **5 Almost Certain** | 🟡 Medium (5) | 🟠 High (10) | 🔴 Critical (15) | 🔴 Critical (20) | 🔴 Critical (25) |
| **4 Likely** | 🟢 Low (4) | 🟡 Medium (8) | 🟠 High (12) | 🔴 Critical (16) | 🔴 Critical (20) |
| **3 Possible** | 🟢 Low (3) | 🟡 Medium (6) | 🟡 Medium (9) | 🟠 High (12) | 🔴 Critical (15) |
| **2 Unlikely** | 🟢 Low (2) | 🟢 Low (4) | 🟡 Medium (6) | 🟡 Medium (8) | 🟠 High (10) |
| **1 Rare** | 🟢 Low (1) | 🟢 Low (2) | 🟢 Low (3) | 🟢 Low (4) | 🟡 Medium (5) |

### Risk Score Interpretation

| **Risk Score** | **Level** | **Action Required** | **Timeframe** |
|----------------|-----------|---------------------|---------------|
| **15-25** | 🔴 Critical | Immediate action required, escalate to management | Within 1 week |
| **10-14** | 🟠 High | Prompt action needed, senior management informed | Within 1 month |
| **5-9** | 🟡 Medium | Planned mitigation, managed through normal processes | Within 3 months |
| **1-4** | 🟢 Low | Monitor and review, accept or apply low-cost controls | Within 12 months |

---

## Risk Register Template

| **Risk ID** | **Asset** | **Threat** | **Vulnerability** | **L** | **I** | **Risk** | **Treatment** | **Owner** | **Status** |
|-------------|-----------|------------|-------------------|-------|-------|----------|---------------|-----------|------------|
| R-001 | Customer DB | Data breach | Weak passwords | 3 | 5 | 🔴 15 | MFA, password policy | IT Manager | In Progress |
| R-002 | Email system | Phishing | User awareness | 4 | 3 | 🟠 12 | Security training | CISO | Planned |
| R-003 | Web server | DDoS attack | No DDoS protection | 2 | 4 | 🟡 8 | Cloud WAF | DevOps | Completed |

### Field Descriptions

- **Risk ID**: Unique identifier (R-XXX format)
- **Asset**: Information asset from inventory (reference Asset Inventory Template)
- **Threat**: Source of risk (cyber attack, natural disaster, human error, etc.)
- **Vulnerability**: Weakness that could be exploited
- **L**: Likelihood score (1-5)
- **I**: Impact score (1-5)
- **Risk**: Risk level calculated from L × I
- **Treatment**: Risk response strategy (see below)
- **Owner**: Person responsible for managing this risk
- **Status**: Current state (Identified / Assessed / Planned / In Progress / Completed / Accepted)

---

## Detailed Risk Assessment Form

### Risk Identification

| **Field** | **Description** | **Example** |
|-----------|-----------------|-------------|
| **Risk ID** | Unique identifier | R-2024-042 |
| **Risk Title** | Short descriptive name | Unauthorized access to customer database |
| **Asset(s) Affected** | Related assets from inventory | Customer Database (AS-2024-001) |
| **Date Identified** | When risk was identified | 2024-01-15 |
| **Identified By** | Who discovered the risk | Security Audit / Incident / Review |

### Threat Analysis

| **Field** | **Description** | **Example** |
|-----------|-----------------|-------------|
| **Threat Source** | Origin of threat | External attacker / Insider / Natural disaster |
| **Threat Actor** | Who/what could exploit | Cybercriminals / Disgruntled employee / System failure |
| **Attack Vector** | How threat could materialize | Brute force attack / Social engineering / Configuration error |
| **Motivation** | Why would they attack | Financial gain / Sabotage / Accidental |

### Vulnerability Analysis

| **Field** | **Description** | **Example** |
|-----------|-----------------|-------------|
| **Vulnerability** | Weakness that enables threat | Weak password policy, no MFA |
| **Current Controls** | Existing security measures | Basic password complexity rules |
| **Control Effectiveness** | How well controls work | Partially effective - bypass possible |
| **Gap Analysis** | What's missing | MFA not enforced, no account lockout |

### Risk Evaluation

| **Field** | **Description** | **Score/Notes** |
|-----------|-----------------|-----------------|
| **Likelihood Before Controls** | Inherent likelihood | 5 (Almost Certain) |
| **Impact Before Controls** | Inherent impact | 5 (Catastrophic) |
| **Inherent Risk** | L × I before controls | 🔴 25 (Critical) |
| **Likelihood After Controls** | Residual likelihood | 2 (Unlikely) |
| **Impact After Controls** | Residual impact | 4 (Major) |
| **Residual Risk** | L × I with current controls | 🟡 8 (Medium) |

### Impact Categories

Assess impact across multiple dimensions:

| **Category** | **Impact Level** | **Description** |
|--------------|------------------|-----------------|
| **Financial** | Major (4) | €500,000 in direct losses, regulatory fines |
| **Operational** | Catastrophic (5) | Core business system unavailable for 3+ days |
| **Reputational** | Major (4) | National media coverage, loss of major clients |
| **Legal/Regulatory** | Moderate (3) | GDPR fine possible, regulatory investigation |
| **Customer Impact** | Major (4) | 10,000+ customers affected, data breach notifications |

*Use highest impact across categories as overall Impact score*

---

## Risk Treatment Options

### 1. Mitigate (Reduce)
**Action**: Implement controls to reduce likelihood or impact
**Example**: Deploy MFA, implement WAF, conduct security training
**When**: Risk score > 5, cost-effective controls available

### 2. Accept (Tolerate)
**Action**: Acknowledge risk and proceed without additional controls
**Example**: Accept low-impact risks, document management approval
**When**: Risk score ≤ 4, cost of controls exceeds benefit

### 3. Transfer (Share)
**Action**: Share risk with third party (insurance, outsourcing)
**Example**: Cyber insurance, cloud provider shared responsibility
**When**: High impact, external party can manage better

### 4. Avoid (Eliminate)
**Action**: Eliminate activity or asset causing the risk
**Example**: Discontinue risky service, remove internet-facing system
**When**: Risk too high, no acceptable treatment possible

---

## Risk Treatment Plan

| **Risk ID** | **Treatment** | **Planned Controls** | **Implementation Cost** | **Target Date** | **Responsible** | **Approval** |
|-------------|---------------|----------------------|-------------------------|-----------------|-----------------|--------------|
| R-001 | Mitigate | Implement MFA, enforce strong passwords | €5,000 | 2024-Q2 | IT Manager | CISO Approved |
| R-002 | Mitigate | Quarterly security awareness training | €3,000/year | 2024-Q1 | HR + CISO | CFO Approved |
| R-003 | Transfer | Cyber insurance policy | €10,000/year | 2024-Q1 | CFO | Board Approved |
| R-004 | Accept | Low-value asset, monitoring only | €0 | N/A | IT Manager | CISO Approved |

---

## Risk Monitoring & Review

### Key Risk Indicators (KRIs)

| **Risk Area** | **KRI** | **Threshold** | **Frequency** |
|---------------|---------|---------------|---------------|
| Unauthorized Access | Failed login attempts | > 100/day | Daily |
| Data Breaches | DLP policy violations | > 5/month | Weekly |
| Phishing | Reported phishing emails | > 10/month | Monthly |
| Vulnerabilities | Unpatched critical CVEs | > 3 outstanding | Weekly |

### Review Schedule

- **Continuous**: Monitor KRIs and automated alerts
- **Monthly**: Review new risks and control effectiveness
- **Quarterly**: Update risk scores and treatment progress
- **Annually**: Complete comprehensive risk assessment
- **Ad-hoc**: After incidents, audits, or significant changes

---

## Compliance Mapping

### ISO 27001
- **Clause 6.1.2**: Risk assessment process
- **Clause 6.1.3**: Risk treatment
- **Clause 8.2**: Information security risk assessment
- **Annex A**: Control selection based on risk

### E-ITS
- **§ 8**: Riskianalüüs requirement
- **§ 9**: Turvatoimingud based on risk level
- Classification: K1/K2/K3 drives control requirements

### SOC 2
- **CC9.1**: Risk assessment processes
- **CC9.2**: Risk mitigation activities

---

## Risk Assessment Methodologies

### Qualitative (Recommended for SMEs)
- Uses descriptive scales (Low/Medium/High)
- Faster, requires less data
- Suitable for most organizations
- This template uses qualitative approach

### Quantitative (Advanced)
- Uses numerical values (ALE, SLE, ARO)
- More precise, requires historical data
- Resource-intensive
- Better for large enterprises or specific high-value assets

### Semi-Quantitative (Hybrid)
- Combines both approaches
- Uses numerical scales with descriptive anchors
- Good balance of accuracy and effort

---

## Common Information Security Risks (Examples)

1. **Cyber Attacks**: Malware, ransomware, DDoS, SQL injection
2. **Data Breaches**: Unauthorized access, theft, leakage
3. **Insider Threats**: Malicious employees, accidental disclosure
4. **Supply Chain**: Third-party vulnerabilities, vendor failures
5. **Physical Security**: Theft, natural disasters, facility access
6. **Compliance**: Regulatory fines, legal action, contractual breaches
7. **Availability**: System failures, outages, capacity issues
8. **Human Error**: Misconfiguration, accidental deletion, poor training

---

## Additional Notes

- Risk assessment is iterative - expect to refine over time
- Involve stakeholders from business, IT, legal, and management
- Document assumptions and decision-making rationale
- Keep risk register as a living document, not a one-time exercise
- Link risks to controls in your ISMS/compliance program
- Management must formally accept residual risks

---

**Template Version**: 1.0
**Last Updated**: 2024-01-04
**Source**: InfoPol - Free InfoSec Resources