5 ateliers EBIOS RM
From scoping to the roadmap
Each workshop builds on the previous one's results. Data flows automatically—no re-entry required.
A1
Scope and security baseline
Definition of the study scope, initial identification of feared events, and applicable security baseline.
- Study identification Title, organization, reference, version, and dates.
- Functional and technical scope Description of the boundaries of the subject of the study.
- High-level feared events (FEs) Initial identification of FEs before the workshops.
- Biens supports List of the digital and physical components of the subject of the study.
- Security values Confidentiality, Integrity, Availability, and Traceability.
- Security baseline Applicable regulatory requirements and good practices.
- EBIOS team composition Included on the report cover page.
A2
Essential assets
Identification and assessment of business processes and critical information using the CIAT criteria.
- Identification of essential assets The organization's business processes and critical information.
- Valorisation DICP Availability, Integrity, Confidentiality, and Traceability—for each essential asset.
- Feared events (FEs) FEs associated with each essential asset, including severity level.
- Impact severity level Configurable 1–4 scale.
- Liens biens essentiels ↔ biens supports Dependencies calculated automatically.
- Dependency mapping Vue graphique biens essentiels / biens supports.
A3
Strategic scenarios
Risk sources, RS/TO pairs, strategic attack paths, and likelihood ratings.
- Risk sources (RS) Nation states, cybercriminals, insiders, hacktivists…
- RS / Target Objective (TO) pairs RS × TO relevance matrix.
- Strategic attack paths RS → EA path with intermediate milestones.
- Cotation vraisemblance 1–4 scale for each strategic scenario.
- Strategic-scenario graph SVG visualization of attack paths.
- AI: attack-path generation Suggests plausible paths for validation from the RS/EA map.
A4
Operational scenarios
Detailed attack methods, attack sequences targeting supporting assets, and operational likelihood ratings.
- Attack methods (AMs) One or more AMs per strategic scenario.
- Detailed attack sequences Successive steps targeting supporting assets.
- Operational likelihood rating 1–4 scale for each attack method.
- Automatic AM ↔ strategic-scenario link Guaranteed W3 → W4 traceability.
- AI: suggested attack methods By type of supporting asset targeted.
- Summary view RS → EA → AM coverage—completeness dashboard.
A5
Risk treatment
Security measures, treatment options, treatment plan, and exportable roadmap.
- Suggested security measures For each residual scenario—tailored to your assets and attack methods.
- Four treatment options Reduction, Transfer, Avoidance, and Acceptance.
- Treatment plan Owners, deadlines, and status—built-in tracking.
- Residual risks after treatment Automatic reassessment of likelihood and severity.
- AI: suggested measures Measures tailored to the context and residual scenarios.
- Exportable roadmap Word + Excel—ready for executive-committee presentation.
6
Pilotage
Measure dashboard, coverage indicators, and tracking of deadlines and owners.
- Measure dashboard In progress / Completed / Overdue—summary view.
- Residual-risk coverage indicators Treatment rate by risk level.
- Deadline and owner tracking Visual overdue alerts.
- Vue globale Treated vs accepted vs ongoing risks—at a glance.
7
Word report
Complete EBIOS RM report generated in one click—with configurable sections, customizable styles, and Excel export.
- Complete EBIOS RM report in one click Every section is generated from your data.
- Sections couvertes Scoping, assets, strategic and operational scenarios, treatment, and appendices.
- Styles Word configurables Customizable fonts, colors, header, and footer.
- Export Excel Matrices, scenario tables, and treatment plan.
