User guide — Polyodos EBIOS RM (standalone version)

This guide covers installing the desktop application, launching the basic functions, and recommendations for use when the risk analysis involves sensitive data or requires a protection marking.

---

1. Installation

Prerequisites

System	Minimum version
Windows	10 64-bit
macOS	12 Monterey
Linux	Ubuntu 20.04 / Debian 11

An internet connection is only required for the first activation and for license renewals (at most once every 30 days). The application then works entirely offline.

Windows

1. Download the EasyRiskSuite-Setup-x.y.exe file from the download area provided by the publisher.
2. Double-click the file and follow the installation wizard.
3. An Polyodos shortcut is created on the desktop. Double-click it to launch the application.

If Windows SmartScreen shows a warning, click More info then Run anyway.

macOS

1. Download the EasyRiskSuite-x.y.dmg file.
2. Drag the Polyodos icon into the Applications folder.
3. On first launch, go to System Settings → Privacy & Security and click Open Anyway.

Linux

chmod +x EasyRiskSuite-x.y.AppImage
./EasyRiskSuite-x.y.AppImage

---

2. First activation

On first launch, the login screen appears. Enter the credentials (email address and password) provided by the publisher. The application checks the validity of your license with the server, then stores an encrypted token locally.

Offline use. Once activated, the application works without a connection for 30 days. Beyond that, a connection is required to renew the license token. Your local data is never erased during this period.

All the data from your analysis is stored locally on your workstation in the application's database. No analysis data is transmitted to the server.

---

3. Create an EBIOS RM project

1. From the home screen, click 1-My Projects in the sidebar.
2. Click + New project.
3. Select the EBIOS RM (IT) type (information system) or EBIOS RM (OT) (industrial system).
4. Enter a meaningful project name, then click Create.

The EBIOS RM menu appears in the sidebar with all the numbered pages.

---

4. Basic functions

Navigation

The sidebar lists all pages in the working order recommended by the method. You can navigate freely between pages at any time — the method is iterative.

EBIOS Risk Manager
├── Metrics
├── ✦ AI Framing
├── Workshop 1
│   ├── 1.1 - Study context
│   ├── 1.2 - Scope
│   ├── 1.3 - Feared events
│   └── 1.4 - Security framework
├── Workshop 2
│   ├── 2.1 - RS/OT pairs
│   ├── 2.2 - RS/OT assessment
│   └── 2.3 - RS/OT → FE correspondence
├── Workshop 3
│   ├── 3.1 - Stakeholders
│   ├── 3.2 - Strategic scenarios
│   └── 3.3 - Ecosystem measures
├── Workshop 4
│   ├── 4.1 - Operational scenarios
│   └── 4.2 - Likelihood assessment
├── Workshop 5
│   ├── 5.1 - Risk summary
│   ├── 5.2 - Treatment strategy
│   ├── 5.3 - PACD
│   └── 5.4 - Residual risks
├── EBIOS RM Report
└── Libraries

Undo / Redo

Every page has ↩ Undo and ↪ Redo buttons in its page header.

• Windows / Linux: Ctrl+Z / Ctrl+Y
• macOS: Cmd+Z / Cmd+Y

Automatic saving

Entries are saved automatically in real time. There is no "Save" button. To archive or transfer a project, use the export function described in section 6.

---

5. Course of the analysis — the 5 workshops

Workshop 1 — Framing and security baseline

1.1 Study context

Start by filling in the framing elements before any other input:

• Objectives — purpose and expectations of the study (accreditation, risk management, certification…)
• Participants — team members with their RACI role
• Time frame — duration of the operational and strategic cycles, start date
• Workshop schedule — planned dates
• Constraints and assumptions — imposed limits and assumptions made

From the Document management tab, also define:

• The protection marking (see section 7)
• The document version history

1.2 Scope

Identify the missions, business values (BV) and supporting assets (SA) of the object being studied. Each supporting asset is linked to one or more business values.

1.3 Feared events

For each business value, define the dreaded compromise scenarios with their severity level (G1 to G4 according to the scale configured in Metrics).

1.4 Security framework

List the frameworks applicable to your organization (ISO 27001, RGS, PSSIE, internal policy…) and the compliance status of each requirement. This baseline serves as the comparison basis for Workshop 5.

---

Workshop 2 — Risk sources

2.1 RS/OT pairs

Select the risk sources from the built-in library (cybercriminal groups, nation states, insiders, human errors…) or create new ones. For each source, associate the targeted objectives among the business values from Workshop 1.

2.2 RS/OT assessment

Rate each pair according to the criteria of motivation, resources and level of activity. The most relevant pairs are retained for Workshop 3.

2.3 RS/OT → FE correspondence

A cross-reference view between the retained RS/OT pairs and the feared events from Workshop 1.

---

Workshop 3 — Strategic scenarios

3.1 Stakeholders

For each entity in the ecosystem (suppliers, service providers, partners), fill in the four danger criteria: dependency, penetration, IS security maturity, trust. The radar mapping visually positions each stakeholder in the danger, control and monitoring zones.

3.2 Strategic scenarios

Build the high-level attack paths linking a risk source to a business value, via stakeholders (intermediate events) and feared events. The scenario's severity is automatically calculated from the feared event involved.

3.3 Ecosystem measures

Associate security measures with critical stakeholders to reduce their residual danger level. The residual mapping is updated in real time.

---

Workshop 4 — Operational scenarios

4.1 Operational scenarios

For each retained strategic scenario, build the technical attack graph. Add elementary actions organized into phases (RECONNAISSANCE → GET IN → FIND → EXPLOIT → OBJECTIVE). Each action is linked to a supporting asset.

Use logical operators to model dependencies between actions:

• AND — all preceding actions are required to proceed
• OR — a single action is enough (default behavior)

4.2 Likelihood assessment

Three methods are available, selectable at any time without losing input:

Method	Principle
Express	Overall likelihood entered directly for each scenario
Standard	Success probability rated for each elementary action
Advanced	Success probability and technical difficulty per action; automatic calculation of the least-effort path

---

Workshop 5 — Risk treatment

5.1 Risk summary

The initial risk mapping positions each scenario according to its severity and likelihood. Identify the unacceptable, tolerable and acceptable risks.

5.2 Treatment strategy

For each scenario, select the treatment strategy (reduction / transfer / refusal / acceptance) and associate security measures. Each measure is characterized by its category (governance / protection / defense / resilience), the owner and the deadline.

5.3 PACD — Documented Action and Compliance Plan

A tracking table for all measures, filterable by category, owner, status and deadline. Exportable to Excel.

5.4 Residual risks

After applying the measures, re-rate the residual severity and likelihood of each scenario. The residual mapping uses the same scales as the initial mapping. Document the accepted residual risks.

---

6. Exports and report

Exports are available from the EBIOS RM Report page in the sidebar.

Export	Format	Content
EBIOS RM Report	Word (.docx)	Full structured report: context, 5 workshops, mappings, summary tables
Data	Excel (.xlsx)	Multi-sheet workbook: BV, SA, FE, RS/OT, scenarios, PACD

The protection marking entered in Workshop 1 is automatically carried over into the header of every page of the generated Word report.

Project backup and restoration

Export a backup: 2-Backup menu → Export/Import tab → Download project (.json). The file can be password-protected from this same page.

Restore: 2-Backup menu → Export/Import tab → drop the .json file in the import area. If the file is encrypted, enter the password.

Importing replaces all data in the current project. Export a backup beforehand if needed.

---

7. Protection marking and recommendations for sensitive data

Set the protection marking

As soon as the project is created, go to 1.1 Study context → Document management tab and select the appropriate protection marking:

Marking	Use
Unprotected	Document for free distribution, no restriction
Sensitive	Distribution limited to people involved in the study
Restricted	Strictly controlled distribution, mandatory marking on every page
Confidential	Named access only, maximum protection level

This marking is automatically carried over into all exports (Word report, headers).

Recommendations for use with sensitive data

These recommendations apply whenever the protection marking is Sensitive, Restricted or Confidential.

Workstation

• Use a workstation managed by your organization. Avoid shared or personal workstations.
• Enable disk encryption: BitLocker (Windows), FileVault (macOS), LUKS (Linux). The application's data is stored unencrypted on disk; without disk encryption, it is accessible in case of theft or loss of the workstation.
• Lock your session as soon as you leave your workstation (Win+L / Ctrl+Cmd+Q).

Exported files (Word, Excel, JSON)

• The generated files contain the entire analysis data. Apply to them the same level of protection as the study itself.
• Do not send them by unencrypted email. Use a secure channel compliant with your organization's policy.
• Include the protection marking in the file name, for example: EBIOS_RM_IS-HR_RESTRICTED_2025-06.docx.
• Password-protect JSON backups from the 2-Backup page before archiving or transmitting them.
• Delete working versions and drafts as soon as they are no longer needed.

Backup storage

• Do not store unencrypted JSON backups on public cloud spaces or those not approved by your organization.
• Keep the encryption password separate from the backed-up file.

Accreditation process

If your organization is subject to an accreditation obligation (OIV, OSE, state administration), using this application in a classified context must be part of your security accreditation process as described by ANSSI (cyber.gouv.fr/lhomologation-de-securite).

The EBIOS Risk Manager label assigned to this application covers the functional compliance with the method. It does not replace a security certification or qualification, and does not guarantee the application's robustness against malicious actions (see §5.6 of the ANSSI v3.1 specification).

---

8. Updates

The application automatically checks for an available update on startup (internet connection required). If an update is available, a notification appears. Click Update to install it; the application restarts automatically.

Your local data is not affected by updates.

To update manually, download the new installer and run it — it replaces the existing version.

---

9. Support

• Email: support.xrisk@gmail.com
• Vulnerability reporting: send your report to support.xrisk@gmail.com, specifying the application version (visible in the About menu).

In the event of a confirmed vulnerability, the publisher commits to notifying CERT-FR (cert.ssi.gouv.fr) and issuing a security advisory to users.