4 ms·

Risk = likelihood * severity

• hef19898 3y ago
  Sometimes one has to include detectability as well.
  • datadrivenangel 3y ago
    Severity should include detectability. If you never detect an issue, it's not an issue because nobody sees it.
    • hef19898 3y ago
      Usually it is a seperate factor, at least as far as P/D-MEAs are concerned. Quick and dirty, sure, it can be included in severity. Personally, I prefer the increased transparency and granularity of having detectability as a different factor.
  • HL33tibCe7 3y ago
    To me, that’s a subcomponent of severity
• contravariant 3y ago
  That's also an approach, but it may lead to endless discussions about how likely something is. It's easier to tell what the worst possible consequence is (what this article calls criticality). After that it's fairly straightforward to figure out if you're doing enough to prevent this scenario from being realized (which is more like coverage = risk * mitigations).