Calculate risk
Example data table
| Scenario | Sensitivity | Likelihood | Controls | Backups | Exposed | Value (USD) | Score | Band |
|---|---|---|---|---|---|---|---|---|
| Internal wiki | 2 | 2 | 4 | 4 | No | 25,000 | ~14 | Low |
| CRM with vendors | 4 | 3 | 3 | 3 | Yes | 300,000 | ~52 | High |
| Payment processing | 5 | 4 | 3 | 2 | Yes | 1,500,000 | ~78 | Critical |
Formula used
Each 1–5 input is normalized to 0–1. The calculator builds a weighted base risk from sensitivity, likelihood, exposure, third-party dependence, and maturity gaps.
mitigation = 0.60·C + 0.40·B
final = clamp( base · (1 − 0.55·mitigation), 0, 1 )
score = 100·final
Annual probability and expected annual loss are planning heuristics derived from the final score and the value you provide.
How to use this calculator
- Select sensitivity based on regulation and confidentiality.
- Estimate threat likelihood using recent incidents and exposure.
- Rate control strength for access, logging, encryption, and DLP.
- Rate backup maturity based on frequency, isolation, and restore tests.
- Rate training and response readiness based on cadence and drills.
- Enter business value to approximate impact and expected loss.
- Press Calculate to see score, band, and top drivers.
- Download CSV or PDF for documentation and reviews.
Article
Risk scoring inputs
Data loss risk starts with consistent inputs. Sensitivity reflects confidentiality, regulatory exposure, and reputational damage. Threat likelihood captures how often adversaries, errors, or outages could reach your data. Internet exposure flags systems reachable from outside networks. Third‑party risk represents vendors, SaaS, contractors, and shared integrations. Controls, backups, training, and incident readiness describe defensive maturity. Using the same 1–5 scale enables comparable scoring across departments. Document assumptions to keep ratings stable.
Probability and loss planning
The calculator converts the composite score into an estimated annual probability curve. This is not a prediction; it is a planning signal that improves prioritization. Impact is estimated by multiplying your stated data value by a sensitivity multiplier, reflecting higher fines and recovery effort for regulated datasets. Expected annual loss equals probability times impact, providing a simple budgetary anchor for security projects and insurance discussions. Update values quarterly as processes change. materially.
Controls that reduce exposure
Control strength aggregates safeguards that prevent exfiltration and accidental deletion. Strong identity controls reduce account takeover; least privilege limits blast radius. Encryption and key management reduce data usefulness when copied. Endpoint protection and patching cut ransomware entry points. Logging, alerting, and data loss prevention improve detection and containment. When the score is high, focus first on controls that block initial access and on monitoring that shortens dwell time. and supports rapid response.
Backup and recovery discipline
Backup maturity is a major loss limiter, especially for destructive events. Mature programs use frequent snapshots, immutable or offline copies, and clear retention aligned to business needs. Regular restore tests validate that data, configurations, and access rights can be recovered under pressure. Separate credentials for backup administration reduce tampering risk. If your top drivers include backup gaps, invest in isolation, automation, and recovery time objectives before adding new features. for critical services.
Using results for governance
Use results to communicate risk in operational terms. Track score changes after projects, audits, and incident lessons learned. Compare systems to decide where segmentation, vendor reviews, or staff training delivers the best return. For governance, document the top drivers and chosen mitigations, then set target bands for each service tier. Pair this output with tabletop exercises to validate readiness and improve stakeholder confidence during high-impact disruptions. in day to day operations.
FAQs
1) Is the score an exact prediction of incidents?
No. It is a structured estimate that compares systems using the same assumptions, helping you prioritize controls and funding with consistent rationale.
2) What value should I enter for data?
Use a realistic total of recovery labor, downtime, customer impact, contractual penalties, and re-creation costs. If unsure, start conservative and refine during reviews.
3) How do backups affect the result?
Higher backup maturity reduces risk because it limits outage duration and rebuild effort. Test restores and isolated copies matter more than backup frequency alone.
4) Why does internet exposure increase risk?
Externally reachable services face broader scanning, credential stuffing, and exploit attempts. Reducing exposure with segmentation and tight access can lower likelihood significantly.
5) How should I treat third-party risk?
Rate dependency and vendor security posture. Strong contracts, access scoping, and periodic reviews can reduce the impact of partner breaches or misconfigurations.
6) How often should I recalculate?
Recalculate after major changes, incidents, or audits, and at least quarterly. Trend scores over time to measure whether mitigations are working.