Stakeholders
Stakeholders (PP) are the external entities interacting with the system under study: suppliers, service providers, partners, customers, regulators. They are used in Workshop 3 of EBIOS RM to build strategic scenarios.
Role in EBIOS RM
A risk source can exploit a stakeholder with insufficient trust to reach your business values without a direct attack. This is the principle behind supply-chain attacks.
Example: a cybercriminal compromises a maintenance provider that has remote access to your industrial systems.
Create a stakeholder
- In Workshop 3, Stakeholders tab, click ＋ Add
- Fill in the fields below
Fields
| Field | Description |
|---|---|
| Name | Label of the entity (e.g. ERP vendor, IT outsourcing provider, Cloud host) |
| Type | Supplier / Service provider / Partner / Customer / Regulator / Subcontractor |
| Description | Role in the ecosystem, services provided, nature of access |
| Dependency | How much the organisation depends on this entity (1 = low → 4 = critical) |
| Trust level | Estimated cybersecurity maturity of the entity (1 = low → 4 = high) |
| Access type | Physical access / Remote logical / Local logical / Shared data / No direct access |
| Access scope | Systems or data the stakeholder has access to |
Assess the criticality of a stakeholder
The tool automatically computes a criticality index from the dependency and trust level:
| Combination | Interpretation |
|---|---|
| High dependency + Low trust | High risk — address as a priority in strategic scenarios |
| High dependency + High trust | Moderate risk — monitor how maturity evolves |
| Low dependency + Low trust | Limited risk — include if access is sensitive |
| Low dependency + High trust | Low risk — include for completeness |
TIP
A stakeholder with direct access to critical supporting assets always deserves an analysis, even if its dependency is low.
Link with strategic scenarios
When building strategic scenarios, select the stakeholder as an attack vector: the risk source uses it as an entry point to reach the targeted business value. The likelihood of the strategic scenario incorporates the stakeholder's trust level.
Stakeholder library
Import generic stakeholders from the library (common cloud hosts, typical IT integrators, maintenance providers…) or save your recurring stakeholders (regular subcontractors, group suppliers) to reuse them in your future projects.
Detail sheet → Save to library → choose local or shared.