High times medium is not a number

Article 21(1) of the NIS2 Directive requires measures that, "taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation", ensure a level of security "appropriate to the risks posed". Cost on one side, risk on the other, and in between the word "appropriate".

That weighing presupposes that both sides come in the same unit. Every organisation knows the cost of a measure in euros. In most organisations the risk sits in a matrix as "severity 3, likelihood 4". High times medium is not a number, and a colour cannot be computed against a quotation.

What the matrix does and does not do

The risk matrix is not wrong. It orders, it prioritises, it is explained in five minutes, and BSI Standard 200-3 as well as ISO 27005 support it. What it cannot do: add two risks, hold a risk against a risk appetite in euros, or say whether a measure at 80,000 euros a year is worth it.

Three numbers anyone can name

The objection comes immediately: nobody knows the frequency of a ransomware incident to two decimal places. True, and no obstacle. Every responsible person can make three statements: not rarer than every 20 years, every five years is realistic, more than once a year would be a surprise. The same for the loss per event: at least, probably, at most.

That is the three-point estimate as used by FAIR, The Open Group’s standard for quantifying information risk. From three values each for frequency and loss a distribution arises, and a Monte Carlo simulation plays through 10,000 years from it. The result is not a number but a distribution of annual loss, and from it the numbers a decision needs can be read.

The four numbers that come out

The expected annual loss, ALE, is the mean across all simulated years: the number for budget and prioritisation. P90 says the loss stays below it in nine years out of ten: the usual planning value for reserves and insurance sums. P50 is often zero for rare events, because in most years nothing happens, and that is no weakness of the method but the truth about rare events. The maximum loss is the worst simulated year, not a limit, but a feel for the tail of the distribution.

Instead of "severity 3, likelihood 4" it then reads: expected annual loss 210,000 euros, below 650,000 euros in nine years out of ten, 2.3 million in the worst simulated year. That is the language in which management and supervisory board decide on budget, insurance and risk appetite.

Why the seed matters more than the decimal place

A simulation that delivers different numbers on every call is worthless in an audit. The risk in euros module in isidaten therefore gives every quantification a fixed seed derived from risk and state: the same data delivers the same numbers on every instance, a report from the previous day can be repeated exactly. Anyone wanting to know how much the result depends on chance recomputes with a different seed; at 10,000 iterations the ALE moves by about one percent. Assumptions and sources sit on the quantification, because they are what an auditor wants to see, not the decimal place.

The matrix follows, but only on click

The quantification does not replace the risk analysis; it feeds it. The P90 of the single loss can be written back into the financial impact dimension, with its own permission and automatic justification, and the matrix follows the simulation. The P90, not the ALE, because the matrix multiplies by likelihood itself, and the ALE already carries the frequency. Saving never changes the analysis.

With a current and a target state the before-and-after comparison arises, and with the costs of the assigned measures the ROSI: what the measure yields per year, measured by ALE difference and cost, one-off costs spread over the depreciation years. That is the calculation Article 21 requires, in the unit it requires.

The question to ask

How many euros of cyber loss per year is your management prepared to accept, and how much do you expect?

If the first number has never been formulated, "appropriate" has so far been a colour.

Sources

Directive (EU) 2022/2555 (NIS2), Article 21(1). Open FAIR, The Open Group, standard for information risk analysis. BSI Standard 200-3 risk management, ISO/IEC 27005:2022.