Risk metrics
Configures the rating scales of the IEC 62443 module: Severity, Likelihood, Risk levels and the L × S matrix. These settings apply to ZCR 2, ZCR 4 and ZCR 5 — changing them mid-study re-rates all existing rows.
Don't mix them up
These metrics are specific to the IEC 62443 module. They are not the same as EBIOS RM's or Industrial Risks', even in a multi-method project.
Tabs
| Tab | Content |
|---|---|
| Severity | Impact scale if the cyber risk materializes |
| Likelihood | Probability of exploitation of an ICS/OT attack vector |
| Risk levels | Possible outcomes of the matrix (Low → Critical) |
| V × S Matrix | Cross-reference — click a cell to cycle through the level |
| Vp & mode | Rating mode and Vp scale |
The likelihood rating mode
This is the module's structuring setting. It applies to ZCR 2 and ZCR 5 together: the standard (§4.6.1) requires the same rating scale for the initial and detailed assessments.
Vc only (default) — a single likelihood entered, cross-referenced with severity. This is the historical behaviour. The "consequence-only" approach of §4.6.5.2 is a special case of it: leaving Vc at maximum on every row amounts to rating consequence only.
Vp × Vc (decomposed) — two axes entered separately, combined via a matrix to produce V, itself cross-referenced with severity. This mode allows crediting non-cyber barriers, which §4.6.5.2 explicitly permits within unmitigated likelihood.
What each axis measures
| Axis | Meaning | Import |
|---|---|---|
| Vp — process robustness | Probability that the event actually materializes once the attacker has taken control. Carries non-cyber barriers, process inertia and buffering capacity. | Importable from a LOPA study |
| Vc — exposure to the adversary | Difficulty of reaching the target, from "well-known ICS techniques" to "highly complex attack". | Never importable, always entered |
The model's consistency check
Vp is invariant between ZCR 5.4 and 5.9: a cyber countermeasure doesn't change process robustness. Only Vc is reassessed after countermeasures. If the residual risk drop comes from a drop in Vp, the rating needs review.
Vp scale and PFD anchors
The Vp scale associates each level with a keyword, a PFD anchor and a number of IPLs.
WARNING
These anchors are a methodological convention of your organization, not a requirement of the standard. They must be documented in the CRS alongside the risk matrix.
SL-T suggestion method
Two methods, adjustable in the Vp & mode tab:
| Method | Principle |
|---|---|
| Severity only | The SL-T follows the consequence, regardless of likelihood. The most literal reading of ZCR 2.1 (unmitigated worst case) and the reference method in SIS analysis. |
| Vp × G matrix | The SL-T accounts for process robustness: at equal consequence, an installation with independent barriers requires less cyber robustness. |
The Vp × G method requires the decomposed rating mode. Neither method uses Vc, deliberately — the SL-T determines the countermeasures that set Vc, so feeding it in would be circular.
Changing modes mid-study
No data is destroyed: the historical likelihood is preserved and remains the reference value in Vc only mode. In decomposed mode, rows without a Vp appear unrated until one is entered.