There are lots of best practices to calculate cyber security risk score. Most of the calculations are based on likelihood and impact but it is proven that general risk scoring methodologies are not good enough to address industrial cyber resilience needs. Our cyber-physical resilience experiences in the field led us to develop a lean cyber risk scoring methodology in ICS domain. It is basically impact driven and it aims to help asset owners to focus on real risks which could affect the processes.

Please find detailed information on this document