Score Likelihood With Evidence Bands
Use evidence bands to make likelihood scoring less arbitrary.
Two analysts score the same vendor outage risk. One says 2 because outages are rare; the other says 4 because the vendor had a bad month. Both are guessing from different evidence. NIST SP 800-30 encourages assessors to consider threat events, vulnerabilities, predisposing conditions, and control effectiveness when estimating likelihood. For workplace risk assessment, evidence bands translate that into a practical scale. The mechanism is calibration. Instead of asking "What number feels right?" define what each band means before scoring. For example: 1 means no credible pathway or strong evidence of control performance; 3 means credible pathway with limited evidence;…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in