EBIOS RM Workshop 1 — Scope and security baseline

1Cadre de l'atelier

Objective	Define the study and project framework and its business and technical scope.
Inputs	Results of a previous risk analysis, if available.
Participants	Management, business teams, CISO, and IT management.
Sorties	Scoping elements (participants and schedule); missions, business values and supporting assets; feared events rated by severity; security baseline and identified gaps.

The workshop comprises four activities: 1-1 define the study framework, 1-2 define the business and technical scope, 1-3 identify feared events, 1-4 determine the security baseline.

It is strongly recommended to formalise everyone's roles and responsibilities from Activity 1.1 in a RACI matrix (Responsible, Accountable, Consulted, Informed), so business teams understand that they are stakeholders in the analysis—not only IT management.

2The risk-management pyramid

The second EBIOS RM fundamental combines two complementary approaches, both developed throughout Workshop 1.

The compliance approach—frameworks and hygiene—covers simple, mass attacks; the scenario approach targets sophisticated attacks specifically directed at the organisation.

Workshop 1 alone covers the pyramid's two lower levels through the security baseline. The top—risk scenarios—requires Workshops 2 to 4. Both approaches complement each other: the regulatory and normative context determines which frameworks form the security baseline; do not confuse the regulatory context with a framework.

3Missions, business values, and supporting assets

Activity 1.2. Three nested concepts must not be confused:

Mission

The function, purpose, and reason for existence of the subject under study. Ultimately, there should be only one or two missions.

Business value

A component important to the organisation in fulfilling its mission: a service, support function, project stage, information, or know-how. Five to ten business values are a sufficient basis.

Supporting asset

An information-system component on which one or more business values rely—digital, physical, or organisational, such as a server, network, technical room, or project team.

Example

Commanditaire	The school
Context	A 15-year-old pupil hacks the school system to improve their grades.
Mission	Managing school results to assess pupils
Business value	Pupils' grades (information)
Supporting asset	School information system

Do not list every business value and supporting asset in the organisation; this is not an exhaustive information-system map. Unselected business values benefit from measures protecting the others. Prefer a high-level description and group information instead of multiplying entries.

Example RACI matrix (Activity 1.1)

Activity	Pierre	Paul	Marjorie	Jacques
Identify the appropriate security baseline	R	A	C	I
Comply with the frameworks	R	A	I	I
Assess the ecosystem threat level	C	C	R	A
Analyse high-level scenarios	i	C	A	C

R = Responsible · A = Accountable · C = Consulted · I = Informed

4Feared events and severity scale

Activity 1.3. A feared event is associated with a business value and concerns a security criterion—availability, integrity, or confidentiality. It describes what must not happen, together with its impact and severity.

Reuse a severity scale already defined by the organisation or in a previous study. Example four-level scale from the training material:

Level	Definition
G1 · Mineur	No operational impact on activity performance or the safety of people and property. The organisation overcomes the situation without significant difficulty.
G2 · Significatif	Reduced activity performance without impact on the safety of people and property. The organisation overcomes the situation with some difficulty in degraded mode.
G3 · Important	Severe activity-performance degradation, potentially with significant impact on the safety of people and property. The organisation overcomes the situation with serious difficulty in highly degraded mode.
G4 · Critique	The organisation is unable to perform all or part of its activity, potentially with severe impact on the safety of people and property. The organisation's survival is threatened.

5The security baseline

Activity 1.4 identifies frameworks applicable to the subject under study—information-security policy, GDPR, ANSSI cyber-hygiene guide, ISO 27001 Annex A, sector regulations—and then measures gaps between those frameworks and the current situation. Every gap is a potentially exploitable vulnerability reused when building operational scenarios in Workshop 4.

The security baseline covers unintentional and everyday risks through hygiene and compliance. EBIOS RM builds risk scenarios only for intentional, targeted threats ; the baseline handles the rest.