1What is EBIOS Risk Manager?
EBIOS Risk Manager (EBIOS RM) is the digital-risk assessment and treatment method published byANSSI (the French National Cybersecurity Agency) with support from Club EBIOS. Unlike a technical-vulnerability approach, it begins by asking who might want to harm us and how, in order to build risk scenarios that are plausible, from an attacker's intentions to concrete technical actions on the information system.
Three definitions of risk, from the most general to the most operational:
Larousse
A more or less probable danger or adverse event to which one is exposed.
ISO 31000:2010
The effect of uncertainty on objectives—often expressed as a combination of an event's consequences and its likelihood.
EBIOS Risk Manager
The possibility that a feared event occurs and its effects disrupt the missions of the subject under study.
2Method overview
| Utilisateurs | Risk managers, CISOs, project managers, cybersecurity experts, and anyone managing risks for a system. |
|---|---|
| Vision | Create a shared understanding of cyber risks between decision-makers and operational teams. |
| Valeurs | Practical (realistic operational measures) · Efficiente (selective rather than exhaustive) · Convaincante (results expressed in business language) · Collaborative (business, technical, security, and management teams at the table). |
3The five fundamentals
- A workshop-based structured approach, adaptable to the study objective. EBIOS RM is a toolbox, not a constraint: detail and activity sequencing are adjusted to the need.
- A synthesis of compliance and risk scenarios —the security baseline, built from frameworks and regulations, covers everyday risks, while scenarios cover targeted, sophisticated attacks (see the risk-management pyramid).
- Alternating between the organisation's and the attacker's viewpoints —this dual perspective reveals scenarios that a single viewpoint would miss.
- Consideration of the ecosystem —providers, suppliers, and partners with low cyber maturity are increasingly exploited as indirect attack vectors, as in SolarWinds and Mimecast.
- An effective rather than exhaustive approach —focus on the most important, urgent, or severe elements instead of trying to cover everything in a document too long to be read.
4The five workshops at a glance
| Atelier | Answers the question | Sortie principale |
|---|---|---|
| 1 — Cadrage & socle | What must be protected, and why? | Missions, business values, supporting assets, severity-rated feared events, and security-baseline gaps. |
| 2—Risk sources | Who is the attacker, and why do they act? | Selected Risk Source / Targeted Objective (RS/TO) pairs, rated for relevance. |
| 3 — Strategic scenarios | Which route will the attacker use? | Ecosystem map and strategic scenarios (high-level attack paths). |
| 4 — Operational scenarios | How will the attacker act in practical terms? | Technical operational scenarios and their likelihood. |
| 5—Risk treatment | Which security strategy should address the identified risks? | Treatment strategy, CSIP (continuous security improvement plan), and residual risks. |
5All pages in this guide
Voir aussi : IEC 62443 standard (complementary OT component), NIS2 / ReCyF (related regulatory framework). Related product module: User guide — Cybersecurity module.