Workshop 1
Workshop 1 defines the scope of the study: what you are protecting (missions, business values, supporting assets), what could go wrong (feared events), and the security measures already in place (baseline security). This is the foundation of the entire EBIOS RM analysis — the following workshops build directly on what is entered here.
Sub-steps of the workshop
| Step | Page | Content |
|---|---|---|
| 1.1 | Study context | Study objectives, constraints, assumptions, mode of use, participants |
| 1.2 | Scope | Missions, business values (essential assets) and supporting assets |
| 1.3 | Feared events | Compromise scenarios for business values, impacts and severity |
| 1.4 | Security framework | Frameworks and security measures already applied (baseline security) |
| 1.5 / 1.6 | Vulnerability assessment, Vuln→Framework matrix, Zones & Conduits | Optional add-ons, notably for OT/industrial scopes |
The detail of the fields, tables and buttons of pages 1.1 to 1.3 (Study context, Scope, Feared events) is described in Study context, Scope & Feared events.
Recommended approach
- Start with Study context (1.1): frame the objective of the study and its mode of use — this determines which workshops are activated afterwards.
- Fill in Missions, Business values and Supporting assets (1.2): a business value with no associated supporting asset cannot be linked to an operational scenario in Workshop 4.
- Describe the Feared events (1.3) for each critical business value, with their severity — they will be reused in the strategic scenarios (Workshop 3) and in the risk level calculation (Workshop 4).
- Complete the Security framework (1.4) with the measures already in place: this avoids proposing redundant measures in Workshop 5.
Don't rush
The quality of workshops 3, 4 and 5 depends directly on the precision of the scope defined here. A supporting asset poorly linked to its business value, or a feared event that is too vague, will ripple through the rest of the analysis.
Going further
See Study context, Scope & Feared events for the full detail of the workshop's first three pages.