I am reviewing NIST SP800-30 rev 1 and I am having a hard time understanding how they determine the distribution of values within the risk matrix. In the document, they define semi-qualitative values – I am assume that these values are used in the calculation – however, the calculations are not provided. I am trying to programmatically calculate the result.
Here is is an example straight from the guideline:
My attempt using [Likelihood of Initiation] * [Likelihood of Occurrence], This does not yield the same results based on the scales provided.
What is the correct formula to calculate this?