Workshop 2
Workshop 2 identifies who could threaten your organisation, and what these threats are seeking to achieve or destroy.
Sub-steps of the workshop
| Step | Page | Content |
|---|---|---|
| 2.1 | RS/OT pairs | Risk sources (RS) and targeted objectives (OT), associated in pairs |
| 2.2 | RS/OT assessment | Relevance rating of the RS/OT pairs |
| 2.3 | RS/OT → feared events mapping | Mapping the retained pairs to the feared events from Workshop 1 |
The fields and buttons of page 2.1 are described in detail in RS/OT pairs.
Recommended approach
- Build the RS/OT pairs (2.1), drawing on the built-in library if needed (cybercriminal groups, states, malicious insiders, human error, natural disasters…) or creating your own sources and objectives.
- Assess the relevance of each pair (2.2) — how likely this source is to target your organisation for this objective.
- Map the pairs to the feared events from Workshop 1 (2.3), keeping only the pairs that genuinely carry risk for your scope.
Keep only what matters
Not every possible risk source needs to be studied in depth. The RS/OT pairs retained here are the ones that will be developed into strategic scenarios in Workshop 3 — a small set of well-qualified pairs is better than an exhaustive but shallow list.
Going further
See RS/OT pairs for the details of page 2.1.