# Cybersecurity Risk Assessment: A Systematic Mapping Review, Proposal, and Validation
## 4 Analyze and Discuss the Results
### Risk Measurement
#### 4.3.1 Qualitative Tools  
The qualitative tools (23 in total) are shown in Table 9. They provide ordinal values of risk exposure. The most frequent scale is low, medium, and high values. Four tools expand the scale to five and seven possible values, ranging from very low to very high. As mentioned earlier, some tools are based on an existing risk assessment model. For example, the most common qualitative risk measurement used in the tools listed in Table 9 is from the ISO 27000 family and NIST CSF. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Sub-Stages** & \multicolumn{2}{c}{_Risk Identification_} & \multicolumn{2}{c}{_Risk Analysis_} & \multicolumn{2}{c}{_Risk Evaluation_} \\ \hline
**Tool** & **Activity 1** & **Activity 2** & **Activity 3** & **Activity 4** & **Activity 5** & **Activity 6** & **Coverage** \\ \hline ADAMANT & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & Full \\ CYWM & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & Full \\ Data protection impact assessment tool & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & Full \\ Mobile risk calculator & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & Full \\ OSCAD-Ciras tool & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & Full \\ RACOMAT & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & Full \\ Risk watch & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & Full \\ [PERSON] model & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & Full \\ SGIS toolbox & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & Full \\ TISRIM & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & Full \\ Trilliant, Suratose tool & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & Full \\ [PERSON] model & ✓ & Partial & Partial & ✓ & ✓ & ✓ & Partial \\ MVS Visualization Platform & ✓ & Partial & ✓ & ✓ & ✓ & ✓ & Partial \\ RL-BAGS & ✓ & ✗ & ✓ & ✓ & ✓ & ✓ & Partial \\ Patch management & Partial & ✓ & ✓ & ✓ & ✓ & ✓ & Partial \\ Cyber risk scoring and mitigation & Partial & Partial & ✓ & ✓ & ✓ & ✗ & Partial \\ (CRISM) tool & & Partial & Partial & ✓ & ✓ & ✓ & ✗ & Partial \\ Rimsha tool & & Partial & Partial & ✓ & ✓ & ✓ & ✗ & Partial \\ MST & Partial & Partial & ✓ & ✓ & ✓ & ✓ & Partial \\ AWWA & ✗ & ✓ & ✓ & ✗ & ✓ & ✓ & ✓ & Partial \\ Asset assessment methodological tool & ✓ & ✗ & ✗ & ✓ & ✓ & ✓ & ✓ & Partial \\ Eye retina & Partial & ✗ & ✓ & ✓ & ✓ & ✓ & ✗ & Partial \\ GFILanguard & Partial & ✗ & ✓ & ✓ & ✓ & ✓ & ✗ & Partial \\ Nikto & Partial & ✗ & ✓ & ✓ & ✓ & ✓ & ✗ & Partial \\ OSINT & Partial & ✗ & ✓ & ✓ & ✓ & ✓ & ✗ & Partial \\ OpenVAS & Partial & ✗ & ✓ & ✓ & ✓ & ✓ & ✗ & Partial \\ Quantitative network security risk situation & ✗ & Partial & ✓ & ✓ & ✓ & ✓ & ✗ & Partial \\ SAINT & Partial & ✗ & ✓ & ✓ & ✓ & ✗ & Partial \\ N circle & Partial & ✗ & ✓ & ✓ & ✓ & ✓ & ✗ & Partial \\ Qualys guard & Partial & ✗ & ✓ & ✓ & ✓ & ✓ & ✗ & Partial \\ Security system analyzer & Partial & ✗ & ✓ & ✓ & ✓ & ✓ & ✗ & Partial \\ Teng algorithm & ✗ & Partial & Partial & ✓ & ✓ & ✗ & Partial \\ CSAT & ✗ & ✓ & ✓ & ✗ & ✓ & ✗ & Partial \\ CSET & ✗ & Partial & ✓ & ✗ & ✓ & ✓ & Partial \\ CSRAS & ✓ & ✗ & ✓ & ✗ & ✓ & ✗ & Partial \\ Nessus & Partial & ✗ & ✓ & ✗ & ✓ & ✗ & Partial \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Sub-stages and activities covered by the risk assessment tools. ISO/IEC 27005:2018 provides recommendations on how to perform qualitative risk measurement. The two main variables are the probability of an incident scenario and the possible process impact if a threat were to exploit a vulnerability. Figure 4 shows each of the two main variables, weighted on a scale of five values ranging from very low to very high, where a numerical value indicates the relationship between the two variables. For example, if the numerical value of the above relationship is between 0 and 2, it is considered low risk; if it is between 3 and 5, it is considered medium risk; and if it is between 6 and 8, it is considered high risk. The NIST cybersecurity framework does not assess risks individually but conducts a global assessment of the organization. The NIST cybersecurity framework defines risk bytiers. The tiers are defined by NIST as levels of framework implementation. These tiers provide the context for how an organization perceives cybersecurity risks and how they can manage such risks.