GRC › Module 2 › Lesson 3
Likelihood Impact
Likelihood and impact literacy names matrix axes, risk appetite alignment, and priority bands — score one fictional risk on YOUR $GRC_LAB before treatment options.
Visual · t37_likelihood_impact
Likelihood impact literacy. $GRC_LAB only. Original Cyberlium.
Opening
Likelihood times impact drives priority — literacy teaches matrix scoring so treatment decisions on $GRC_LAB fictional orgs use consistent definitions.
Likelihood estimates how often a threat scenario may occur — rare, occasional, frequent. Impact estimates harm — reputational, financial, operational, regulatory — if the scenario succeeds. A 5×5 matrix maps combined scores to priority bands aligned with org risk appetite on YOUR fictional template. Cyberlium writes likelihood-impact row on YOUR $GRC_LAB — scenario, likelihood score, impact score, priority band, appetite alignment note. Next: Risk Lab.
1. Matrix components (named)
Likelihood axis: defined frequency bands with examples for YOUR fictional org. Impact axis: harm categories — confidentiality, integrity, availability, regulatory. Combined score: matrix lookup or formula. Appetite: which bands require treatment vs accept with approval.
On $GRC_LAB, write matrix row — likelihood, impact, combined priority, appetite note for one fictional scenario.
Command guide
Try these commands — Matrix components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST CSF — https://www.nist.gov/cyberframework ISO 27001 — https://www.iso.org/isoiec-27001-information-security.html CIS Controls — https://www.cisecurity.org/controls
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export GRC_LAB=${GRC_LAB:-$HOME/cyberlium-lab/t37-grc}
cat > "$GRC_LAB/notes/likelihood-impact-matrix.md" <<'EOF'
# Likelihood × Impact Matrix — LAB-ORG-001 literacy
| L \ I | 1 Low | 2 Med | 3 High |
|-------|-------|-------|--------|
| 1 Low | Low | Low | Med |
| 2 Med | Low | Med | High |
| 3 High| Med | High | Crit |
## Examples (fictional)
- R-001 missing MFA on admin: L=2 I=3 → High
- R-002 stale TLS on dev-only host: L=1 I=1 → Low
- R-003 vendor subprocessors unreviewed: L=2 I=2 → Med
Use consistent scale; record rationale in risk register notes column
EOFCommand — copy this
grep -E 'Likelihood|R-001|MFA' "$GRC_LAB/notes/likelihood-impact-matrix.md"
python3 -c "print('Matrix: document rationale — fictional LAB-ORG-001 risks only')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST CSF (https://www.nist.gov/cyberframework); ISO 27001 (https://www.iso.org/isoiec-27001-information-security.html); CIS Controls (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why defined scales prevent priority arguments
Two analysts scoring 'Medium' without definitions produce inconsistent registers. Appetite statements from fictional board charters anchor when acceptance is allowed. Documented matrix survives internal audit sampling on lab templates.
Students score lab scenarios on notes — production matrices follow enterprise risk committee approval.
3. Lab boundary
Forbidden: scoring real employer incidents without authorization in lab register. Allowed: likelihood-impact card — one scored scenario with $GRC_LAB fictional org context.
Ship: likelihood-impact row for YOUR lab scenario. Next: Risk Lab.
4. What you ship: likelihood-impact row for $GRC_LAB
Scenario, likelihood, impact, priority band. $GRC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Likelihood-impact row. $GRC_LAB named. File t37-m02-l03-likelihood-impact.txt chmod 600.
6. Wrong vs right: fraudulent certs vs YOUR lab templates
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Score impact as Critical for every risk because 'security is important.' Skip appetite alignment note.
Right
Write likelihood-impact row for YOUR $GRC_LAB scenario. Next: Risk Lab.
Mission: score one risk on YOUR lab matrix
1) Define likelihood and impact scales. 2) Score one fictional scenario. 3) Name priority band and appetite note. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Appetite defines when acceptance is allowed — not every High risk gets the same treatment.
Knowledge Check
APPLY: Likelihood in risk matrix primarily estimates:
Multiple choice
Knowledge Check
APPLY: True or False: Impact estimates harm if the scenario succeeds.
True or False
Knowledge Check
APPLY: Likelihood-impact literacy on Cyberlium uses:
Multiple choice