Case 2 - Ninety Days to Justify a SCADA Refresh
Northvale Water operates 220 pumping stations and a SCADA estate that has passed end-of-support. The regulator has set a 90-day deadline to submit a risk assessment supporting a £2.3 million refresh. Northvale has five security staff, no incident-loss history, and no actuarial data. A consultancy offers a full quantitative Monte Carlo model for £180,000 and 14 weeks; an internal option is a facilitated workshop producing qualitative High/Medium/Low ratings in two weeks. The executive sponsor wants 'a number in pounds' to justify the spend to the board, and the regulator has said it will not prescribe a method. The deadline cannot move; the refresh procurement decision is due in week 10. Two previous internal assessments disagreed: one rated the SCADA risk 'High', the other 'Medium', with no record of the assumptions behind either.
1. Recommend an assessment approach for Northvale and justify it against ISO/IEC 27005.
Read the worked answer
ISO/IEC 27005 is deliberately method-agnostic. It requires an approach suited to context that is repeatable and produces results comparable enough to evaluate against risk criteria. That rules out nothing by name, but it does rule out a 14-week Monte Carlo study against a 90-day statutory deadline, with procurement due in week 10 and no loss data. Monte Carlo is defensible when distributions rest on credible data or on documented expert elicitation; here it would manufacture precision, and the board would anchor on a figure the regulator could not trace.
Recommend a semi-quantitative approach. Define consequence bands covering euro loss, service interruption in hours, regulatory notification and safety. Define likelihood as expected frequency per year with an explicit horizon. Score the SCADA scenarios in a facilitated workshop with operations and OT engineers, recording assumptions and disagreements. Run a sensitivity check - double the likelihood, halve the impact - and report the resulting range. Reserve quantitative treatment for the two or three scenarios that actually drive the spend decision.
2. The sponsor insists on 'a number in pounds'. How do you meet that need without overstating confidence?
Read the worked answer
Give a number with an explicit range and a stated basis: expected annual loss of £X–£Y per scenario, derived from the consequence and likelihood bands and the recorded assumptions. Explain that the range is the honest output of the available evidence, and that a single point estimate unsupported by incident data would be harder, not easier, to defend to the regulator.
Then present the comparison the board actually needs: £2.3 million of capital against the expected loss range, plus the consequences that cannot be priced - enforcement action, loss of supply, safety. Identify which assumptions would move the answer most: attacker capability, time to detection, proportion of the estate affected, duration of outage. State the cost of delay.
This satisfies the sponsor's requirement for a financial figure while preserving traceability, which is what ISO/IEC 27005 expects from recording and reporting. It also makes clear what evidence would narrow the range in the next cycle.
3. The regulator asks why the two earlier assessments disagreed. What process changes prevent a recurrence?
Read the worked answer
The disagreement came from undocumented assumptions, not from the choice of method. Introduce a documented method and scale definitions with worked examples; a record for each assessment of scope, participants, date, information sources, assumptions and the reasoning behind every rating; and a calibration step in which assessors independently score one or two reference scenarios and then reconcile differences.
Retain the previous assessment so that changes can be explained rather than rediscovered, and define review triggers: major change, incident, new threat or vulnerability information, expiry of a control, and the passage of a set interval.
Where two assessments conflict, the cause should be visible - a different assumed attacker, exposure window or impact dimension. Maintain a versioned register with named owners. This is the recording and reporting element of the risk management process; without it, each reassessment is a fresh opinion rather than an update.