A five by five risk matrix scores each risk twice, once for how likely it is and once for how bad it would be, on a scale of one to five. Multiplying the two gives a number from 1 to 25, and the number puts the risk in a band that says what to do about it.
It is the method most information security risk registers use, and it satisfies the requirement in ISO/IEC 27001:2022 clause 6.1.2 for criteria that produce consistent, comparable results, provided the scales are defined. A matrix where five means whatever the person scoring feels that day satisfies nothing.
A likelihood scale
Define likelihood in terms people can answer from experience. Frequency works better than adjectives.
| Score | Name | Meaning |
|---|---|---|
| 1 | Rare | Not expected. No known case here or in similar organizations. |
| 2 | Unlikely | Could happen, but not expected within the next few years. |
| 3 | Possible | Might happen within the next year or two. Has happened to similar organizations. |
| 4 | Likely | Expected within the next year. Has happened here before. |
| 5 | Almost certain | Expected several times a year, or already happening. |
An impact scale
Impact needs more than one dimension, because a risk can be cheap and still stop the business. Score each dimension and take the highest. Replace the wording with amounts and durations that mean something for your organization, and have top management approve them.
| Score | Name | Operations | Customers and data | Legal and regulatory |
|---|---|---|---|---|
| 1 | Negligible | No noticeable disruption. | No customer affected. | None. |
| 2 | Minor | One team slowed for hours. | A few customers inconvenienced. | Internal breach of policy. |
| 3 | Moderate | A key service down for hours. | Some customer data exposed or many customers affected. | A reportable event or a contract breach. |
| 4 | Major | A key service down for days. | Sensitive data exposed at scale. | Regulatory investigation or a significant claim. |
| 5 | Severe | The business cannot operate. | Loss of customer trust across the market. | Loss of a license, or penalties that threaten the business. |
From score to action
Score is likelihood multiplied by impact. These are the bands used in our downloadable risk register.
| Score | Band | What it means |
|---|---|---|
| 16 to 25 | Critical | Treat now. Report to top management. Do not accept without their written approval. |
| 10 to 15 | High | Treat with a plan, an owner and a date. Review every month. |
| 5 to 9 | Medium | Treat where the cost is reasonable, or accept with the risk owner's approval. |
| 1 to 4 | Low | Accept and monitor. Review once a year. |
Three worked examples
| Risk | Likelihood | Impact | Score and band | After treatment |
|---|---|---|---|---|
| A phishing email leads to a mailbox being taken over. | 4. It has happened here before. | 3. Customer correspondence exposed. | 12, High | Multi-factor authentication for all mailboxes lowers likelihood to 2. Residual 6, Medium. |
| Ransomware encrypts the file server and its backups. | 3. Common among similar organizations. | 5. The business cannot operate. | 15, High | Offline backups with tested restores lower impact to 3. Residual 9, Medium. |
| A laptop holding customer data is lost. | 3. Laptops are lost every year or two. | 4. Sensitive data exposed. | 12, High | Full-disk encryption lowers impact to 1. Residual 3, Low. |
Inherent and residual risk
Score each risk twice. Inherent risk is the score with no controls, or with only the controls you have today, depending on which definition you choose. Pick one, write it down, and use it for every risk. Residual risk is the score once the planned treatment is in place. The risk owner accepts the residual risk, and that acceptance is a record ISO/IEC 27001 clause 6.1.3 asks you to keep.
What a matrix cannot do
- The numbers are ranks, not measurements. A score of 20 is not twice as bad as 10. Use the score to sort and to decide who must approve, not to add up or average.
- Different combinations give the same score. Rare but severe (1 by 5) and almost certain but negligible (5 by 1) both score 5 and need very different responses. Many organizations escalate anything with an impact of 5, whatever the score.
- Two people will score the same risk differently until the scales are defined and a few examples have been scored together. Do that calibration once a year.
- It does not replace judgment about what to fix first. Cost, effort and how many risks one control treats all matter and none of them is in the score.