Risk methodology

Scales, matrix, bands and appetite used to score every risk in this organization.

v3 · Draftv2 active since Jan 12 · scored risks keep their version until re-scored

Matrix size

5 × 5 follows NIST SP 800-30 Very Low … Very High.

How a cell gets its band

Score = L × I, banded by rangesSimple and symmetric. Edit ranges below.

Lookup table (asymmetric)Click cells to set bands, as in 800-30 Table I-2.

Score groups

Ranges cover 1–25 with no gaps

–

Category	Tolerance (max residual)	Statement	Accepts above tolerance
Cyber	Medium	No tolerance for loss of CUI; accept minor availability risk on non-CUI systems.	DWDana Whitfield
Supply chain	High	Accept single-source risk where a qualified alternate exists within 90 days.	ESElena Sorokin
Quality	Medium	No escapes of nonconforming product to the customer.	PNPriya Natarajan
People	Medium	Accept turnover risk; not loss of access control.	SASofia Alvarez
Operational	High	Accept short outages of back-office systems to fund engineering capacity.	DWDana Whitfield

Scales

Appetite and tolerance by category

Category	Tolerance (max residual)	Statement	Accepts above tolerance
Cyber	Medium	No tolerance for loss of CUI; accept minor availability risk on non-CUI systems.	DWDana Whitfield
Supply chain	High	Accept single-source risk where a qualified alternate exists within 90 days.	ESElena Sorokin
Quality	Medium	No escapes of nonconforming product to the customer.	PNPriya Natarajan
People	Medium	Accept turnover risk; not loss of access control.	SASofia Alvarez
Operational	High	Accept short outages of back-office systems to fund engineering capacity.	DWDana Whitfield