How to calculate risk score

[acholyn]

see this doc for full context
alt slack link: ARC Slack

Background

fields that contribute to risk score:

• classification
• protection status
• NHS DSPT
• data stored outside UK/EEA

locations that contribute to risk score:

• DSH, TRE, NHS (low effect)
• Microsoft 365, managed devices (moderate effect)
• personal devices, unencrypted media, unsecured recording devices (high effect)

Assets stored in multiple locations shouldn't be summed but the highest score should be used as that asset's risk score. Possibly a slight bonus to the score if in multiple locations?

Study risk score + category should be based on the highest-risk asset within the study

Researchers should only see the category (critical - red; vulnerable - amber; uncomfortable - yellow; manageable - green)

[acholyn]

I think the only real change is the multi location handling - if there's more than 1 location, we can either add 1 for each location it's held in or add 1 point per eg 2 or 3 locations - and not showing the sum total, but rather the highest of the values

thoughts @finleybacon @t-young31

[finleybacon]

ok so asset risk score and study risk score are two different scores, but we're suggesting Study risk score is inherited from the highest asset risk score present in the Study. makes sense to me.

if there's more than 1 location, we can either add 1 for each location it's held in or add 1 point per eg 2 or 3 locations

I don't follow: add increments to the Study score on top of the highest asset risk score if that asset is stored in >1 location?

what would it look like:

Study	Asset	risk score (IG View)	risk score (User View)
	a1	4/14	manageable
	a2	5/14	uncomfortable
	a3	6/14	vulnerable
	a4	10/14	critical
Study A	-	14/14	critical

?

one last thought - if giving a number score, as opposed to a category, I think it needs to be out of another number: like 5/10. otherwise one can't be confident of the meaning of just "5".

[acholyn]

I don't follow: add increments to the Study score on top of the highest asset risk score if that asset is stored in >1 location?

I meant adjusting the asset scores. so if the study has 5 assets, they each get a +1 (if doing a +1 per 5 locations) or could each get a +5 (if we did +1 per 1 location)

[acholyn]

I think it needs to be out of another number: like 5/10. otherwise one can't be confident of the meaning of just "5".

agree, we need to figure out a reasonable max and can then figure out thresholds for categories

[acholyn]

will give an (semi) arbitrary solution and we can implement and adjust later if needed

[acholyn]

closing as spawned #866