# Cybersecurity Risk Assessment: A Systematic Mapping Review, Proposal, and Validation
## 4 Analyze and Discuss the Results
### Risk Measurement
#### 4.3.1 Qualitative Tools
The tiers characterize the practices of an organization with the following values: partial (Tier 1), risk-informed (Tier 2), repeatable (Tier 3), and adaptive (Tier 4). Figure 4: Risk assessment according to ISO/IEC 27005:2018. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Tool** & **Description of the Measurement Method** & **Risk Scale** \\ \hline ADAMANT & It uses the ISO/IEC 27001:2013 risk measurement method & Very low, Low, Rather low, Medium, Rather high, High, and Very high \\ RACOMAT & It uses the ISO/IEC 27001:2013 risk measurement method & Low, Medium, and High \\ TISRIM & It uses the ISO/IEC 27001:2013 risk measurement method & Low, Medium, and High \\ AWWA & It uses the NIST CSF risk measurement method & Low, Medium, and High \\ CSET & It uses the NIST CSF risk measurement method & Low, Medium, and High \\ CSAT & It uses the NIST CSF risk measurement method & Low, Medium, and High \\ Patch management & It uses the NIST CSF risk measurement method & Low, Medium, and High \\ CSRAS & It uses the NIST 800-3 risk measurement method & Low, Medium, and High \\ Trilliant, Suratose tool & It establishes impact and probability risk values using the OSWAP & Low, Medium, High, and Critical \\ Asset assessment & It uses the EBIOS risk measurement method considering (C) & Low, Medium low, Medium, Medium \\ methodological tool & confidentiality, (I) integrity, and (A) availability & high, and High \\ SGIS toolbox & It uses (C) confidentiality, (I) integrity, and (A) availability & Low, Medium, High, Critical, and Highly \\ OSCAD-Ciras tool & It uses the variables: probability of the event, consequences of the event, class of countermeasures, and countermeasures implemented \\ IVS & It uses set theory to describe specific scenarios for each asset, vulnerability, and risk scenario using architectural risk analysis (ARA) & Low, Medium, and High \\ Eye retina & There is no information on how it performs the measurement & Low, Medium, and High \\ GFILanguard & There is no information on how it performs the measurement & Low, Medium, and High \\ N circle & There is no information on how it performs the measurement & Low, Medium, and High \\ Nessus & There is no information on how it performs the measurement & Low, Medium, and High \\ Nikto & There is no information on how it performs the measurement & Low, Medium, and High \\ OpenVAS & There is no information on how it performs the measurement & Low, Medium, and High \\ Security system analyzer & There is no information on how it performs the measurement & Low, Medium, and High \\ Qualys guard & There is no information on how it performs the measurement & Low, Medium, and High \\ Risk watch & There is no information on how it performs the measurement & Low, Medium, and High \\ SAINT & There is no information on how it performs the measurement & Low, Medium, and High \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Tools with qualitative risk measurement models. Other tools, such as the Tritilanunt and Suratose tools, perform risk measurement with another known method. For example, the Open-Web Application Security Project (OWASP) risk assessment model, which scores risk using the OWASP risk level matrix [48], is shown in Table 10.  
A group of tools (asset assessment methodological tool or SGIS toolbox) uses the three main attributes of cybersecurity (availability, integrity, and confidentiality) to measure the risk. On the other hand, tools such as OSCAD-Ciras and MVS create a unique risk measurement considering specific variable relationships, such as the probability of occurrence and threats or set theory for specific assets or previously defined vulnerabilities. The last group of tools needs to provide more information on how risk is measured. These tools (Nessus, SAINT, OpenVAS, Nikto, Eye retina, GFILanguard, N circle, security system analyzer, and Qualys guard) are focused on vulnerability analysis. They perform a vulnerability scan at a technical level.