Risk evaluation

Abstract

Risk evaluation is the process of comparing the results of the risk analysis with the risk evaluation criteria defined during the context establishment to determine whether the cyber-risks are acceptable. We also need to consider whether some risks that we have regarded as separate actually are instances of the same risk and therefore should be aggregated and evaluated as one risk. Furthermore, as preparation for the risk treatment, we group risks according to relationships such as shared vulnerabilities or threats. This chapter demonstrates risk evaluation, risk aggregation and risk grouping of the running example based on the risk analysis results obtained in Chap. 8.