Guide for Conducting Risk Assessments
APPENDIX G > LIKELIHOOD OF OCCURRENCE

LIKELIHOOD OF OCCURRENCE

DETERMINING THE LIKELIHOOD OF THREAT EVENTS CAUSING ADVERSE IMPACTS
his appendix provides: (i) a description of potentially useful inputs to the likelihood55
determination task; and (ii) exemplary assessment scales for assessing the likelihood of
threat event initiation/occurrence, the likelihood of threat events resulting in adverse
impacts, and the overall likelihood of threat events being initiated or occurring and doing damage
to organizational operations, assets, or individuals. The assessment scales in this appendix can be
used by organizations as a starting point with appropriate tailoring to adjust for any organization-
specific conditions. Tables G-2, G-3, G-4, and G-5, outputs from Task 2-4, provide relevant
inputs to the risk tables in Appendix I.
TABLE G-1: INPUTS - DETERMINATION OF LIKELIHOOD
Description
Provided To
Tier 1
Tier 2
Tier 3
From Tier 1 (Organization level)
- Likelihood information and guidance specific to Tier 1 (e.g., likelihood information related to
organizational governance, core missions/business functions, management/operational policies,
procedures, and structures, external mission/business relationships).
- Guidance on organization-wide levels of likelihood needing no further consideration.
- Assessment scale for assessing the likelihood of threat event initiation (adversarial threat events),
annotated by the organization, if necessary. (Table G-2)
- Assessment scale for assessing the likelihood of threat event occurrence (non-adversarial threat
events), annotated by the organization, if necessary. (Table G-3)
- Assessment scale for assessing the likelihood of threat events resulting in adverse impacts,
annotated by the organization, if necessary. (Table G-4)
- Assessment scale for assessing the overall likelihood of threat events being initiated or occurring and
resulting in adverse impacts, annotated by the organization, if necessary. (Table G-5)
No
Yes
Yes
If not
provided
by Tier 2
From Tier 2: (Mission/business process level)
- Likelihood information and guidance specific to Tier 2 (e.g., likelihood information related to
mission/business processes, EA segments, common infrastructure, support services, common
controls, and external dependencies).
Yes
Via
RAR
Yes
Via
Peer
Sharing
Yes
From Tier 3: (Information system level)
- Likelihood information and guidance specific to Tier 3 (e.g., likelihood information related to
information systems, information technologies, information system components, applications,
networks, environments of operation).
- Historical data on successful and unsuccessful cyber attacks; attack detection rates.
- Security assessment reports (i.e., deficiencies in assessed controls identified as vulnerabilities).
- Results of monitoring activities (e.g., automated and nonautomated data feeds).
- Vulnerability assessments, Red Team reports, or other reports from analyses of information systems,
subsystems, information technology products, devices, networks, or applications.
- Contingency Plans, Disaster Recovery Plans, Incident Reports.
- Vendor/manufacturer vulnerability reports.
Yes
Via
RAR
Yes
Via
RAR
Yes
Via
Peer
Sharing
55 The term likelihood, as discussed in this guideline, is not likelihood in the strict sense of the term; rather, it is a
likelihood score. Risk assessors do not define a likelihood function in the statistical sense. Instead, risk assessors assign
a score (or likelihood assessment) based on available evidence, experience, and expert judgment. Combinations of
factors such as targeting, intent, and capability thus can be used to produce a score representing the likelihood of threat
initiation; combinations of factors such as capability and vulnerability severity can be used to produce a score
representing the likelihood of adverse impacts; and combinations of these scores can be used to produce an overall
likelihood score.
T