I m doing a Risk analysis according to an information security risk management guideline and in the risk assessement table there was a column called "initial Likelihood of risk scenario". What is the difference between the likelihood of a risk scenario and the initial likelihood of a risk scenario?

  • Where are you seeing this? What's the context? Is it talking about the inherent risk?
    – schroeder
    Jun 20 at 10:36
  • hello @schroeder i m doing a risk assessment according to an audit . "initial likelihood of risk scenario" is a column from the Risk assessment table and this assessement is based on the ISRM (information security risk management) Guidelines .
    – Zorghost
    Jun 20 at 11:12
  • What type of audit? Can you link to the document with this column? You have not provided enough context.
    – schroeder
    Jun 20 at 12:45
  • Initial likelihood means the likelihood prior to mitigation.
    – hft
    Jun 21 at 18:08

1 Answer 1


Without further information on the risk assessment methodology you are using there cannot be a definite answer, but a common way of managing risk in information security would be the following:

  1. Identification: A threat or vulnerability to an asset is identified by any suitable method.
  2. Assessment: With information collected on the asset and threat, a likelihood of occurrence and a potential impact is determined to calculate the Risk Score.
  3. Treatment: Measures are applied to reduce either the likelihood or the impact of a threat in order to reduce the risk. Alternatively, the risk is transferred, accepted, or avoided.
  4. Re-assessment and risk decision: The risk is periodically re-assessed to update the risk score based on the likelihood and impact, which may change due to the environment and technical- or organizational progress. The re-evaluation may also change the risk decision (treat, transfer, accept, avoid)

From this view, the "initial" likelihood or impact is the likelihood or impact at discovery of the threat. Further risk treatment may reduce these values.

The initial value is usually kept for performance review / KPI reporting of the Risk Management System.

  • Thank you for the answer , what you said makes sense so I will assume that this is what is means .
    – Zorghost
    Jun 20 at 14:08
  • @Zorghost but you won't provide more information so that you can be sure?
    – schroeder
    Jun 20 at 14:20
  • @schroeder I am still new to the cybersecurity field , so I d rather not sharing any type of documentation because I don´t know what data can be shared and what not . But sir I really appreciate the time that you took reading my question and contributing to it
    – Zorghost
    Jun 20 at 14:27
  • @Zorghost the answer here is asking for the risk methodology. You can't share that?
    – schroeder
    Jun 21 at 8:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.