I am reviewing NIST SP800-30 rev 1 and I am having a hard time understanding how they determine the distribution of values within the risk matrix. In the document, they define semi-qualitative values – I am assume that these values are used in the calculation – however, the calculations are not provided. I am trying to programmatically calculate the result.

Here is is an example straight from the guideline:

NIST SP800-30 r1 Risk Scale

NIST SP800-30 r1 Likelihood of Threat Impact

NIST SP800-30 r1 Likelihood of Threat Initiation

My attempt using [Likelihood of Initiation] * [Likelihood of Occurrence], This does not yield the same results based on the scales provided.

My Attempt

What is the correct formula to calculate this?

1 Answer 1


Although I dont use this particular metric I use something similar.

The only time I've seen differentiation from the table is using greater then (vs greater then or equal to). You are using the minimum values out of a range instead of a midpoint.

In the examples you have using 9 vs 8 for the high value should do it. Quantative values like this are really just estimates.

  • Hi Tim, thank you for the answer. I am still not getting the same results that NIST published in the document. I know that qualitative risk analysis is highly subjective, but it seems that their must be some math involved in how they distribute values across the matrix. Otherwise, I don't understand the point of them using semi-quantitative values.
    – m3ta
    Commented Jul 28, 2014 at 17:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .