EBIOS Risk Manager key terms

A French national method for assessing and treating digital risks, built around five sequential workshops that connect business stakes, risk scenarios, and security measures in a structured, auditable way.

The French national cybersecurity agency that publishes and maintains the EBIOS Risk Manager method, along with related guides and labels used by public and private organizations in France.

The opening workshop that defines the study perimeter, the business and regulatory values at stake, the baseline security posture, and the reference frameworks used to evaluate the target object.

The workshop that identifies and prioritizes risk sources, their motivations and capabilities, and the high-level objectives they might pursue against the studied object.

The workshop that builds strategic scenarios by pairing prioritized risk sources with business values, expressing what an adversary could achieve and which feared events would result.

The workshop that translates strategic scenarios into operational scenarios, describing concrete attack paths across supporting assets and mapping them to likely threat events.

The closing workshop that decides how to treat each risk, selects and prioritizes security measures, and defines the residual risk level accepted by the organization's leadership.

The explicit boundary of the study, listing the business processes, information systems, sites, suppliers, and interfaces included or excluded, so that findings stay comparable and defensible.

An asset or activity the organization considers essential, such as a service, process, information set, or reputation, whose degradation would matter to stakeholders and drive risk analysis.

A technical or organizational element, such as a server, application, network, facility, or supplier, that supports business values and can be targeted by an attack path.

A discrete object inside the scope, such as a system, process, or third party, for which the analysis records values, assets, and applicable security requirements during the study.

A person, group, or entity with the intent and capability to harm the organization, characterized by motivation, resources, and access rather than by a specific attack technique.

A structured description of a risk source covering motivation, resources, capability, and constraints, used to judge which objectives are realistic and to prioritize scenarios accordingly.

The outcome a risk source seeks, such as data theft, service disruption, fraud, or influence, expressed independently of the technical means used to reach it.

A high-level narrative combining a risk source, a target objective, and a business value, describing the feared event that would occur if the objective succeeded.

A detailed attack path showing how a strategic scenario could be realized through supporting assets, threat events, and elementary actions, used to identify where controls are needed.

The adverse outcome on a business value that the organization most wants to avoid, such as outage of a critical service, disclosure of sensitive data, or loss of integrity.

A concrete event on a supporting asset, such as exploitation of a vulnerability, credential compromise, or physical intrusion, that contributes to an operational scenario.

The smallest step in an attack path, describing what an adversary does at a given asset, which helps analysts place controls precisely along the scenario.

A control selected to prevent, detect, or limit a risk, expressed with an owner, a scope, and an expected effect so that its implementation can be tracked and evaluated.

The decision to reduce, transfer, avoid, or accept a risk, choosing measures and recording rationale, owners, and timelines so that leadership can approve the outcome.

The risk remaining after selected security measures are applied, which must be judged against the organization's risk appetite and formally accepted by an accountable authority.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, used as the reference when deciding whether residual risk is tolerable.

An assessment of how probable a scenario is, often expressed in qualitative levels informed by risk source capability, exposure, and the effectiveness of existing controls.

The severity of consequences if a feared event occurs, judged across dimensions such as operations, finances, legal obligations, reputation, and safety of people.

A combined rating derived from likelihood and impact, used to rank scenarios, compare options, and communicate priorities to decision makers in a consistent way.

The current state of security controls and practices in the scope, recorded during framing so that gaps and improvements can be measured against recognized reference frameworks.

A recognized set of requirements or good practices, such as ISO/IEC 27001 or a national guide, used to structure the baseline assessment and to justify selected measures.

A weakness in an asset, process, or configuration that a threat event could exploit, identified so that measures can remove or compensate for it within a scenario.

The sequence of elementary actions and threat events an adversary would follow across supporting assets to reach a target objective and trigger a feared event.

A person or organization with an interest in the study or its outcomes, including business owners, IT teams, suppliers, regulators, and leadership who approve risk decisions.

The accountable person who accepts a risk, funds treatment, and monitors the associated measures, ensuring decisions are traceable to a named authority rather than a committee.

The property that each scenario, measure, and decision can be linked back to its source evidence and forward to its owner, supporting audits and later reviews.

A maintained record of identified scenarios with their ratings, owners, selected measures, and status, used to track treatment over time and support periodic review.

The recurring cycle of reviewing scope, scenarios, and measures after changes or incidents, updating the analysis so the risk picture stays current and useful.