Skip to Content

Wiki source code of Risk Methodology

Last modified by Lee Pedley on 2026/09/21 21:59
Show last authors
1 {{velocity}}
2 #set ($settingsDoc = $xwiki.getDocument('ISMS.Settings'))
3 #set ($settings = $settingsDoc.getObject('ISMS.Code.SettingsClass'))
4 #set ($riskLowMax = 4)
5 #set ($riskMediumMax = 9)
6 #set ($riskHighMax = 14)
7 #set ($riskAppetite = 15)
8 #set ($reviewHorizon = 30)
9 #set ($evidenceHorizon = 30)
10 #set ($documentHorizon = 30)
11 #if ($settings)
12 #if ($settings.getProperty('riskLowMax').getValue()) #set ($riskLowMax = $settings.getProperty('riskLowMax').getValue()) #end
13 #if ($settings.getProperty('riskMediumMax').getValue()) #set ($riskMediumMax = $settings.getProperty('riskMediumMax').getValue()) #end
14 #if ($settings.getProperty('riskHighMax').getValue()) #set ($riskHighMax = $settings.getProperty('riskHighMax').getValue()) #end
15 #if ($settings.getProperty('riskAppetiteThreshold').getValue()) #set ($riskAppetite = $settings.getProperty('riskAppetiteThreshold').getValue()) #end
16 #if ($settings.getProperty('reviewHorizonDays').getValue()) #set ($reviewHorizon = $settings.getProperty('reviewHorizonDays').getValue()) #end
17 #if ($settings.getProperty('evidenceHorizonDays').getValue()) #set ($evidenceHorizon = $settings.getProperty('evidenceHorizonDays').getValue()) #end
18 #if ($settings.getProperty('documentHorizonDays').getValue()) #set ($documentHorizon = $settings.getProperty('documentHorizonDays').getValue()) #end
19 #end
20 {{html wiki="true" clean="false"}}
21 <style>.risk-matrix{border-collapse:collapse;max-width:760px}.risk-matrix th,.risk-matrix td{border:1px solid #cfd6dd;padding:10px;text-align:center}.risk-matrix td{font-weight:600}.method-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:14px;margin:18px 0}.method-card{border:1px solid #d9dfe5;border-radius:7px;padding:15px}</style>
22 <div class="box infomessage"><strong>Risk methodology</strong><br/>This application uses a configurable 5 x 5 management model. It is a local methodology, not a prescribed ISO/IEC 27001 scoring method.</div>
23 <div class="method-grid"><div class="method-card"><h3>Likelihood (1-5)</h3><ol><li>Rare</li><li>Unlikely</li><li>Possible</li><li>Likely</li><li>Almost certain</li></ol></div><div class="method-card"><h3>Impact (1-5)</h3><ol><li>Insignificant</li><li>Minor</li><li>Moderate</li><li>Major</li><li>Severe</li></ol></div><div class="method-card"><h3>Configured bands</h3><p>Low: score <= $riskLowMax<br/>Moderate: <= $riskMediumMax<br/>High: <= $riskHighMax<br/>Critical: > $riskHighMax<br/>Residual risk review threshold: >= $riskAppetite</p><p><a href="$xwiki.getURL('ISMS.Settings','edit')">Edit thresholds</a></p></div></div>
24 <h2>5 x 5 score matrix</h2>
25 <table class="risk-matrix"><thead><tr><th>Impact / Likelihood</th>#foreach($l in [1,2,3,4,5])<th>$l</th>#end</tr></thead><tbody>
26 #foreach($i in [5,4,3,2,1])<tr><th>$i</th>#foreach($l in [1,2,3,4,5])#set($s=$i*$l)<td>$s<br/><small>#if($s <= $riskLowMax)Low#elseif($s <= $riskMediumMax)Moderate#elseif($s <= $riskHighMax)High#else Critical#end</small></td>#end</tr>#end
27 </tbody></table>
28 <h2>How to use the risk record</h2><ol><li>Describe the asset/process, threat and vulnerability.</li><li>Assess inherent likelihood and impact before treatment.</li><li>Select a treatment decision and link relevant controls.</li><li>Create treatment records for mitigation actions.</li><li>Assess residual likelihood and impact after considering treatment.</li><li>Use status and target date to manage the lifecycle; accepted risk should reflect an authorised decision under your governance process.</li></ol>
29 {{/html}}
30 {{/velocity}}