ZCR5 — Detailed risk assessment

ZCR 5 conducts the detailed risk analysis for each scenario retained by ZCR4: threat, vulnerabilities, severity, likelihood, risk, SL-T, countermeasures and residual risk — through to the treatment decision and session documentation.

Two ways to enter data

Tab-based entry (one scenario at a time, steps 5.1 → 5.13) suits in-depth analysis. The grid view offers a spreadsheet-like alternative: all analyses as rows, steps as columns — faster for bulk completion or spotting gaps.

Navigation

Main bar: Scenarios · Countermeasures · Method (flowchart of the approach) · 5.13 Documentation · Guide.

Global actions: + New scenario, ↳ ZCR4 (n) (imports the ZCR4 risks requiring detailed analysis), ✦ Generate scenarios (AI).

For an open scenario, sub-navigation across 8 steps: 5.1 Threats · 5.2 Vulnerabilities · 5.3 Severity · 5.4 Likelihood · 5.5 Risk · 5.6 SL-T · 5.7-5.8 Countermeasures · 5.9-5.12 Residual.

5.1 — Threats

• Scenario label
• ZCR5 library scenario — import via 📚 picker
• Threat source — predefined list
• Motivation / Capability — buttons 1 to 4, score computed automatically
• Analyzed zone(s)/conduit(s)
• Linked ZCR2 risk
• Description / attack vector
• Attack vectors · MITRE steps · Final threat accordion (see MITRE ATT&CK section below)
• Potentially affected supporting assets

5.2 — Vulnerabilities

ICV (vulnerability criticality index) rating per supporting asset, from 0 (N/A) to 4, with filters for Zones / Common / Hide N/A / Hide unrated. A "Common/transverse vulnerabilities" block groups vulnerabilities shared across several assets.

5.3 — Severity

Recap of the consequences entered in ZCR2 (↓ Copy button), description of consequences, and rating of the impact/severity level via level buttons.

5.4 — Likelihood

Rating of unmitigated likelihood, with a reminder of vulnerabilities rated ICV ≥ 2 to justify the chosen level.

In decomposed rating mode, two axes are entered: Vp (process robustness) and Vc (exposure to the adversary), combined into V by the matrix defined in Risk metrics. Unlike ZCR 2 where Vc is fixed at worst case, here it is refined based on the actual attack paths of the zone.

Vp is invariant between 5.4 and 5.9

A cyber countermeasure does not change process robustness. Only Vc is re-assessed after countermeasures. If the drop in residual risk comes from a drop in Vp, the rating needs to be revisited — this is the model's consistency check.

With the "SIS Analysis" profile, a 6-factor (EUROCAE) likelihood calculator and CRRF/CIPL valuation of countermeasures are added to this step.

5.5 — Risk

The unmitigated cyber risk is computed automatically from Severity × Likelihood, using the same matrix as ZCR2/ZCR4.

5.6 — SL-T per zone/conduit

Table linking each affected zone/conduit to the scenario, with V, G, risk, and the SL-T set via SL1 to SL4 buttons. This is where the SL-T suggested in ZCR 3 is confirmed or refined against the detailed unmitigated risk.

A single source of truth

The SL-T belongs to the zone, not the scenario: entering it in 5.6 updates the same value as in ZCR 3.

5.7-5.8 — Countermeasures

📋 Selection / 📚 Library toggle. In selection mode: add countermeasures from the library (filterable by Foundational Requirement), each with a Status (Existing/To implement) and Effectiveness (1-4). The residual risk (5.9) is recalculated (V' × G' → R').

5.9-5.12 — Residual

Residual likelihood and impact, Unmitigated vs. Residual comparison, tolerable threshold (overridable per scenario), additional countermeasures (from the library or entered manually), and analysis status (In progress / ✓ Completed).

5.11 — Decide the fate of each risk

The standard does not allow a residual risk above the threshold to be left without an explicit decision: the organization must rule on it, and the decision must be traced in the report.

Decision	What it commits to
Accept	The risk is knowingly assumed. Justification is essential — it is what distinguishes an acceptance from an unfinished analysis.
Transfer	The risk is carried by a third party (insurance, contractual clause, managed service). Specify the transfer vehicle.
Mitigate	Additional countermeasures (5.12) are chosen to bring the risk below the threshold.

The decision is entered in the 5.11 tab of an analysis, or directly in the "Decision (5.11)" column of the grid view. Missing decisions are flagged in the CRS completeness check.

5.13 — Documentation

Sub-tabs: Risks (summary per scenario), Zones (summary per zone/conduit with SL-T), Sessions (+ Add a ZCR5 session button with a methodological checklist), Documents.

MITRE ATT&CK for ICS

The MITRE ATT&CK for ICS framework — a catalog of attack tactics and techniques specific to industrial systems — is integrated directly into the threat analysis:

• In the 5.1 Threats tab, the "Attack vectors · MITRE steps · Final threat" accordion lets you select the intermediate steps of the attack chain based on MITRE ATT&CK for ICS tactics, before concluding on the retained final threat.
• The Guide tab devotes a full section to the MITRE ATT&CK for ICS attack chain, with a phase diagram and two reference tables:
  • Final tactics — Phase / MITRE Tactic / OT example / IEC 62443 countermeasure
  • Feared event ↔ MITRE mapping — Primary MITRE tactic / Associated MITRE techniques

MITRE ATT&CK for ICS library

The full catalog of tactics and techniques is managed in Libraries → 5-MITRE ATT&CK for ICS (/iec62443/bibliotheque-mitre-ics), importable into ZCR5 scenarios.

AI scenario generation

The ✦ Generate scenarios button proposes detailed threat scenarios (label, zone, threat, consequences, impact, likelihood) that can be imported directly, drawing where needed on the CVEs surfaced by the ZCR1 vulnerability analysis.