Guide for Conducting Risk Assessments
APPENDIX D

TABLE D-3: ASSESSMENT SCALE - CHARACTERISTICS OF ADVERSARY CAPABILITY
Qualitative
Values
Semi-Quantitative
Values
Description
Very High
96-100
The adversary has a very sophisticated level of expertise, is well-resourced, and can generate
opportunities to support multiple successful, continuous, and coordinated attacks.
High
80-95
The adversary has a sophisticated level of expertise, with significant resources and opportunities
to support multiple successful coordinated attacks.
Moderate
21-79
The adversary has moderate resources, expertise, and opportunities to support multiple successful
attacks.
Low
5-20
The adversary has limited resources, expertise, and opportunities to support a successful attack.
Very Low
0-4
The adversary has very limited resources, expertise, and opportunities to support a successful
attack.
TABLE D-4: ASSESSMENT SCALE - CHARACTERISTICS OF ADVERSARY INTENT
Qualitative
Values
Semi-Quantitative
Values
Description
Very High
96-100
The adversary seeks to undermine, severely impede, or destroy a core mission or business
function, program, or enterprise by exploiting a presence in the organization's information systems
or infrastructure. The adversary is concerned about disclosure of tradecraft only to the extent that it
would impede its ability to complete stated goals.
High
80-95
The adversary seeks to undermine/impede critical aspects of a core mission or business function,
program, or enterprise, or place itself in a position to do so in the future, by maintaining a presence
in the organization's information systems or infrastructure. The adversary is very concerned about
minimizing attack detection/disclosure of tradecraft, particularly while preparing for future attacks.
Moderate
21-79
The adversary seeks to obtain or modify specific critical or sensitive information or usurp/disrupt
the organization's cyber resources by establishing a foothold in the organization's information
systems or infrastructure. The adversary is concerned about minimizing attack detection/disclosure
of tradecraft, particularly when carrying out attacks over long time periods. The adversary is willing
to impede aspects of the organization's missions/business functions to achieve these ends.
Low
5-20
The adversary actively seeks to obtain critical or sensitive information or to usurp/disrupt the
organization's cyber resources, and does so without concern about attack detection/disclosure of
tradecraft.
Very Low
0-4
The adversary seeks to usurp, disrupt, or deface the organization's cyber resources, and does so
without concern about attack detection/disclosure of tradecraft.
TABLE D-5: ASSESSMENT SCALE - CHARACTERISTICS OF ADVERSARY TARGETING
Qualitative
Values
Semi-Quantitative
Values
Description
Very High
96-100
The adversary analyzes information obtained via reconnaissance and attacks to target persistently
a specific organization, enterprise, program, mission or business function, focusing on specific
high-value or mission-critical information, resources, supply flows, or functions; specific employees
or positions; supporting infrastructure providers/suppliers; or partnering organizations.
High
80-95
The adversary analyzes information obtained via reconnaissance to target persistently a specific
organization, enterprise, program, mission or business function, focusing on specific high-value or
mission-critical information, resources, supply flows, or functions, specific employees supporting
those functions, or key positions.
Moderate
21-79
The adversary analyzes publicly available information to target persistently specific high-value
organizations (and key positions, such as Chief Information Officer), programs, or information.
Low
5-20
The adversary uses publicly available information to target a class of high-value organizations or
information, and seeks targets of opportunity within that class.
Very Low
0-4
The adversary may or may not target any specific organizations or classes of organizations.