From informing strategic decision-making to ensuring regulatory compliance, a clear understanding of cyber risk is essential for modern organizations. But with a constantly shifting threat landscape, how can organizations accurately measure and track their level of exposure?

Cyber risk scores offer a tangible way to measure your organization’s risk profile and cybersecurity posture. This article explains how to calculate risk scores, unpacks several risk scoring methodologies, and answers some common questions around measuring and mitigating organizational risk.

What is a cyber risk score?

A cyber risk score measures an organization’s risk exposure compared to the strength of its cybersecurity posture. It’s like a report card for the organization’s overall asset and risk management. 

Organizations use risk scores to assess their own internal security posture as well as evaluate potential vendors and partners. The better your risk score, the more likely you are to close deals, secure partnerships, save on insurance rates, and attract merger and acquisition opportunities.  

Cyber risk scores are typically represented either as a whole number, kind of like a credit score, or as a percentage that indicates what portion of identified risk has been mitigated by security controls. The remainder is either accepted or residual risk. 

Types of risk scores: 

• Internal risk scores: Risks posed by insider threats, such as human error, data or asset loss, bugs or malfunctions, and malicious actors

External risk scores: Risks posed by external threats, such as cyberattacks, natural disasters, and political and socioeconomic changes.

4 Cyber risk scoring methodologies to quantify risk

There are several risk scoring methodologies organizations can follow to evaluate and quantify risks. Here are a few types of risk scoring models and how they’re applied: 

NIST cyber risk score

The National Institute for Standards and Technology (NIST) created a cyber risk scoring solution that helps organizations quantify risks across systems and components. 

Here’s how it works:

Step 1: Risk profiling

This process determines how important a system is to the organization’s mission and operations. Stakeholders determine the appropriate risk appetite and create a risk profile methodology. That methodology is then mapped to business processes and systems to identify and quantify risk likelihood and impact. This risk profile is used to define total potential risk and identify applicable controls. 

Step 2: Risk scoring

Using a quantitative risk-based analysis, organizations can understand risk from one system compared to another. Every control is assigned an initial weighting (1-10) based on its importance to the organization’s security and privacy posture. This is the control baseline risk score. 

A data type questionnaire is then used to modify the baseline risk score by assigning CIA (confidentiality, integrity, and availability) ratings (1-10) based on the importance of the data type. System components are then assessed based on implemented controls. The sum of all Component potential risk equals the System potential risk

ISS ESG cyber risk score

ISS ESG, a part of Institutional Shareholder Services (ISS), offers an evaluation of companies' cybersecurity risk based on a proprietary methodology. The ISS ESG Cyber Risk Rating aims to provide an understanding of a company's exposure to cybersecurity threats and their ability to manage those threats.

The exact proprietary algorithms used by ISS ESG are publicly disclosed, but the general approach usually involves several key steps:

1. Data Collection: ISS ESG aggregates vast amounts of data from publicly available sources, commercial data providers, and other undisclosed methods.
2. Assessment Categories: The assessment generally touches on areas such as:
3. The complexity of the IT environment
4. The likelihood of a company suffering a cyberattack
5. The potential impact of such an attack
6. The company's preparedness and resiliency against cyber threats
7. Compliance with relevant regulations and standards
8. Risk Indicators: Within each assessment category, several risk indicators are evaluated. These can range from technical measures, such as patch management practices and network security configurations, to internal processes such as employee training and incident response plans.
9. Scoring: Based on this data, a risk score is assigned. Typically, these scores are represented in a tiered or graded fashion (e.g., low risk to high risk).
10. Benchmarking: Scores can be compared against industry peers, providing a relative understanding of where the company stands in terms of cybersecurity risk compared to its competitors.
11. Continuous Monitoring and Updates: ISS ESG's methodology involves periodic updates to ensure the risk ratings remain current.
12. Detailed Reports: Along with the overall risk score, detailed reports provide insights into specific areas of concern, potential vulnerabilities, or best practices that a company may be following.

FAIR cyber risk score

Factor Analysis of Information Risk (FAIR) is a model for assessing and quantifying risk in financial terms, making it different from more traditional, qualitative risk assessments.

Here’s how FAIR cyber risk scoring generally works:

1. Risk definition: FAIR defines "risk" as the probable frequency and magnitude of a future loss. The FAIR model breaks down risk into two primary components:
2. Loss Event Frequency (LEF): How often you expect a loss event to occur in a given timeframe. LEF is influenced by two factors: Threat Event Frequency (how often a threat actor might target the asset) and Vulnerability (the likelihood that a threat will manifest as a loss).
3. Loss Magnitude: How much you expect to lose when the event occurs. This includes both primary loss (i.e., initial response costs) and secondary loss (i.e., residual losses, usually affecting other entities such as customers).
4. Quantitative Analysis: The next step is to assign quantitative values to risk factors and components. For example, if there's a 10% chance that a data breach will occur in the next 12 months, and the expected cost of a breach would be $1 million, the annualized loss expectancy (ALE) would be $100,000.
5. Monte Carlo Simulations: FAIR often uses Monte Carlo simulations to predict future events. This method uses a large number of simulations to estimate the probability distributions for loss event frequency and loss magnitude, providing a more comprehensive view of potential risk outcomes.
6. Risk Treatment: Quantifying risk in financial terms can help organizations make more informed decisions about how to prioritize and treat risk—whether it's accepting it, transferring it (e.g., through insurance), mitigating it (e.g., by implementing new controls), or avoiding it altogether.
7. Continuous Assessment: Like all risk models, FAIR is most effective when used as part of a continuous risk assessment process.

FAIR provides a different perspective from many traditional cybersecurity frameworks. This quantitative approach can offer clarity for business leaders and executives and help them align cybersecurity concerns with larger business objectives and financial considerations.

Key risk indicators (KRIs)

Key risk indicators are used to identify and track potential risks that could potentially jeopardize business operations or growth. KRIs help organizations detect emerging threats or vulnerabilities and so they can take preemptive action. KRIs are often quantitative, such as a percentage, count, or ratio, with thresholds that trigger alerts for management to act. 

KRI should be:

• Measurable: KRIs are quantifiable by percentages, numbers, etc. 
• Predictive: KRIs can be used as an early warning system.
• Informative: KRIs are used to shape decision-making. 
• Comparable: KRIs can be benchmarked internally and to industry standards. 

Improve your cyber risk score with Secureframe

Secureframe offers end-to-end risk management capabilities to help you identify, assess, and mitigate organizational risk. 

• Assess risk and document treatment plans to satisfy regulatory and compliance requirements
• Automatically assess and treat risks with Comply AI. The fully automated risk assessment workflow includes risk information and details, risk treatment, residual risk, risk score, and justification. 
• Easily add and track risks with the risk library. Our risk library includes NIST risk scenarios for categories including IT, Fraud, Legal, and Finance. 
• Link risks to controls and view history to coordinate risk management strategies with compliance requirements. Close any gaps in your risk management program and demonstrate the steps you’ve taken to strengthen your security posture over time. 

To learn more about Secureframe’s powerful risk management capabilities, schedule a demo with a product expert.