Should my organisation use a 5-by-5 risk matrix (i.e. a scale between 1 and 5 for both likelihood and impact) stipulated in the risk assessment guidance document to determine risk levels?
Organisations are strongly encouraged to use a scale of between 1 and 5 to determine both likelihood and impact when assessing cybersecurity risks. By doing so, organisations can aid CSA in aggregating and viewing cybersecurity risks at the national level consistently. This enables CSA to identify and alert organisations of any systemic risks (at both sectoral and national level) which they could be exposed to.