Study context, Scope & Feared events
These three pages form the core of Workshop 1: they define the objective of the study, what you are protecting (missions, business values, supporting assets), and what could go wrong (feared events).
1.1 — Study context
Page /ebios/contexte — frames the study before starting the analysis.
Study objectives
- Objective type — choose the objective category from the cards on offer (radio)
- Objective description — free text detailing the scope and stakeholder expectations
Constraints and Assumptions
- Constraints — limits imposed (e.g. scope limited to internal IT systems, fixed budget, deadline imposed by the IT department, regulatory constraints…)
- Assumptions — suppositions made to carry out the study (e.g. existing security measures are maintained, trusted third parties are deemed reliable…)
Mode of use
Select the method's mode of use from the cards on offer — each mode indicates which workshops (A1 to A5) it covers. This choice determines which workshops are relevant to run for your study.
Participants
Section dedicated to the list of study participants (roles involved in the scoping).
Scope before you analyse
Take the time to validate objectives, constraints and assumptions with stakeholders before tackling the scope — this avoids having to backtrack once the analysis has started.
1.2 — Scope (Missions, Business values, Supporting assets)
Page /ebios/bienssupports — organised into Matrix, Missions, Business values, Supporting assets tabs.
Missions
A mission groups one or more business values. Table columns:
| Column | Description |
|---|---|
| Name | Mission label |
| Description | What the mission covers |
| Linked BVs | Business values attached (＋ BV button to link, ✕ to unlink) |
| Linked supporting assets | Supporting assets inherited from the linked business values |
＋ Mission button to create a new row.
Business values (BV)
A business value is a process, piece of information or asset whose compromise would have a significant impact on the organisation.
| Column | Description |
|---|---|
| Name | Short, explicit label (e.g. Customer data, Billing process) |
| Category | Classification of the business value |
| Functional type | (optional column, "Functional type" toggle) |
| Description | What this value represents for the organisation |
| Owner | Entity or person in charge |
| Supporting assets | Supporting assets that carry this business value |
Supporting assets (SA)
Supporting assets are the technical and organisational components that carry the business values (e.g. AD server, Site-to-site VPN).
BV → SA linking
A supporting asset can carry several business values. Use the links in the Matrix tab to map these dependencies — they will serve as the basis for the operational scenarios of Workshop 4.
1.3 — Feared events (FE)
Page /ebios/evenementsredoutes — a feared event describes a compromise scenario for a business value and its impacts.
Toolbar
| Button / Control | Function |
|---|---|
| 👁 View / ✏ Edit | Toggles read / edit view |
| ☰ Columns | Visible-column picker (Supporting assets, Likelihood, Impact justification) |
| ＋ Feared event | Adds a row |
| 📚 (in the Feared event cell) | Opens the library of pre-built feared events, filterable by search |
| ✎ (in the Impacts cell) | Opens the impact category selection panel |
Table columns
| Column | Description |
|---|---|
| Business value | Selected from the list defined in 1.2, with its category shown as a tag |
| Feared event | Free text, or chosen from the library (📚) |
| Impact categories | Checkboxes from the list of impacts (financial, reputational, legal, operational…) |
| Supporting assets | (optional, enabled via ☰ Columns) |
| Severity | G1 to G4 level, per the configured scale |
| Likelihood | (optional, enabled via ☰ Columns) |
| Impact justification | (optional, enabled via ☰ Columns) |
Feared events library
The 📚 button offers ready-written feared events, classified by typical business value. This speeds up drafting while keeping consistent wording — you can always adapt the suggested text.
Chaining into the rest of the study
The business values and supporting assets defined here will be reused in the operational scenarios (Workshop 4). The feared events and their severity feed directly into the risk level calculation in Workshop 4 (Severity × Likelihood).
See also Workshop 1 — Overview.