The risk methodology defines how Varmo rates risks: likelihood and impact result in the risk level via the risk matrix. It also includes the damage categories and the risk acceptance criteria. This guide is aimed at ISMS managers who set up risk management.
Before you start
- You need a functional role with the permission to configure risk management; by default, these are the ISMS managers.
- Every organisation starts with the methodology according to BSI Standard 200-3: four levels each for likelihood (“rare”, “medium”, “frequent”, “very frequent”) and impact (“negligible”, “limited”, “considerable”, “existence-threatening”), and four risk levels (“low”, “medium”, “high”, “very high”; the BSI standard calls them risk categories). It is already active.
- Define the methodology before the first risk assessment. After a change, you should reassess assessed risks (see “What happens next”).
- You will find the settings under ISMS settings › Risks › Risk methodology.
| Likelihood | negligible | limited | considerable | existence-threatening |
|---|---|---|---|---|
| very frequent | low | high | very high | very high |
| frequent | low | medium | high | very high |
| medium | low | low | medium | high |
| rare | low | low | medium | medium |
Likelihood in four levels (rows: very frequent, frequent, medium, rare) and impact in four levels (columns: negligible, limited, considerable, existence-threatening) result in the risk level low, medium, high or very high.
Choosing a methodology
Varmo keeps the template according to BSI Standard 200-3 unchanged: the levels, names, colours and matrix of this methodology cannot be changed. If you need a different matrix, use New methodology from template to create a 5x5 risk matrix or 6x6 risk matrix. There, you define the levels, names, colours and the matrix yourself.
A new methodology is initially inactive as long as another one is active. With Activate, it becomes active and the previous one is deactivated. Your organisation always assesses with exactly one active methodology.
How to define the damage categories
You define yourself what, for example, “considerable” means for your organisation, ideally per damage category with specific thresholds such as the amount of damage in CHF or downtime. This is also possible with the BSI methodology.
- Open the active methodology under ISMS settings › Risks › Risk methodology.
- For impact, click Define damage categories (later Manage categories) and record categories such as financial, reputation, business process or data protection.
- Edit each impact level and describe, per category, which damage belongs to this level. Save and continue to level … takes you through all levels.
If the methodology has damage categories, each risk is rated per category. The highest level across all categories is decisive (maximum principle).
How to define the risk acceptance criteria
The criteria determine who may retain a risk or residual risk of which level.
- Open ISMS settings › Risks › Reporting & treatment and go to the Risk acceptance section.
- Choose a rule for each risk level of the active methodology:
- Risk owner alone: the risk owner accepts it themselves.
- With approval: after the risk owner, a functional role that you choose approves, for example top management.
- Not acceptable: the risk can be retained neither with the “Accept” option nor as a residual risk. Further measures are needed.
- Save.
The preset is: highest level not acceptable, second-highest only with approval by the “Top management” functional role, the others by the risk owner alone.
What happens next
- If you change the matrix of a custom methodology, Varmo immediately re-rates the affected risks.
- After a change of methodology, assessed risks keep their assessment until they are reassessed. The risk list points this out. The ratings per damage category of the previous methodology are lost in the process.
- If the functional role for approval has no members, the approval waits until it is filled. No one steps in automatically.
- The active methodology is also the basis for the data protection impact assessment.
Frequently asked questions
Do I have to define damage categories?
No. If the general descriptions of the levels are sufficient for you, you can do without them. Without specific descriptions, however, everyone rates differently, and assessments are harder to compare.
Can I adjust the BSI matrix?
No, the levels and matrix of the BSI methodology remain unchanged in Varmo. You can adjust the damage categories and their descriptions. For your own matrix, create a methodology from the 5x5 or 6x6 template.
What comes after the methodology?
Reporting and assessing risks. See Reporting, reviewing and treating risks.