Purpose
Turn a described cyber risk scenario into a defensible, repeatable risk score — likelihood × impact, severity tier, and a recommended treatment action — using NIST 800-30 or ISO 27005 scales, so risks can be ranked consistently on a risk register without ad-hoc gut calls.
When to Use
Invoke this skill when the user asks to:
- Score or rate a specific cyber risk, threat, or vulnerability
- Assign a severity tier (Critical/High/Medium/Low) to a risk scenario
- Prioritize risks for a risk register or remediation backlog
- Convert an audit or pentest finding into a scored risk entry
- Decide whether to mitigate, transfer, accept, or avoid a given risk
- Produce a one-paragraph risk summary for a report or steering committee
Inputs Required
Before starting, collect:
- Risk scenario: 1–3 sentence description of the threat, asset, and potential loss event
- Affected asset(s): System, data, or process at risk (and data classification if known)
- Scoring framework: NIST 800-30 or ISO 27005 (defaults to NIST 800-30 if unspecified)
- Likelihood evidence: Known threat activity, existing controls, exposure, or exploitability
- Impact dimensions: Which of confidentiality, integrity, availability, financial, regulatory, or reputational are affected
- Risk appetite / tolerance: Any thresholds the organization has set (defaults to standard tolerance if unspecified)
- Existing controls: Compensating or mitigating controls already in place
If likelihood or impact evidence is thin, score conservatively (round up) and flag the assumption explicitly in the summary.
Instructions
Step 1: Score Likelihood (1–5)
Rate the probability of the threat successfully occurring within a 12-month horizon. Anchor the rating to observable evidence, not intuition.
| Score | Rating | Definition |
|---|---|---|
| 5 | Very High | Actively being exploited or near-certain to occur; no effective controls |
| 4 | High | Likely within 12 months; weak or partial controls; known exploit exists |
| 3 | Moderate | Credible and plausible; some controls present but gaps remain |
| 2 | Low | Possible but unlikely; strong controls in place |
| 1 | Very Low | Rare; requires improbable conditions or defeated by layered controls |
Adjust the raw likelihood down when existing controls demonstrably reduce exploitability. State the driver behind the score.
Step 2: Score Impact (1–5)
Rate the consequence if the risk materializes, taking the highest impact across the affected dimensions (worst-case dimension sets the score).
| Score | Rating | Definition |
|---|---|---|
| 5 | Severe | Business-ending, major regulatory breach, mass data loss, or extended outage of critical systems |
| 4 | Major | Significant financial loss, reportable breach, material regulatory penalty, or key service disruption |
| 3 | Moderate | Contained loss, limited data exposure, recoverable outage, minor regulatory attention |
| 2 | Minor | Localized impact, easily recovered, negligible regulatory or reputational effect |
| 1 | Negligible | Immaterial impact absorbed by normal operations |
Note which dimension (CIA, financial, regulatory, reputational) drove the score.
Step 3: Calculate Risk Score and Assign Severity Tier
Compute Risk Score = Likelihood × Impact (range 1–25) and map to a severity tier using the 5×5 matrix:
| Risk Score | Severity Tier |
|---|---|
| 20–25 | Critical |
| 12–19 | High |
| 6–11 | Medium |
| 1–5 | Low |
State the calculation explicitly (e.g., "Likelihood 4 × Impact 5 = 20 → Critical"). If NIST 800-30 was selected, reference the qualitative likelihood/impact combination; if ISO 27005, present the score as the risk level derived from the risk matrix.
Step 4: Recommend a Treatment Action
Select one primary treatment and justify it against the tier and risk appetite:
- Mitigate: Reduce likelihood or impact via controls — default for Critical and High risks
- Transfer: Shift risk via insurance, contract, or third party — for high-impact, hard-to-control risks
- Accept: Formally acknowledge and monitor — appropriate for Low and some Medium risks within tolerance
- Avoid: Eliminate the activity or asset creating the risk — for risks with no acceptable treatment
Include one concrete first action (a specific control, transfer mechanism, or acceptance criterion) — not a generic "improve security."
Step 5: Write the Risk Summary
Produce a single tight paragraph that states the scenario, the likelihood and impact scores with their drivers, the calculated score and tier, and the recommended treatment with its first action. Flag any assumptions made under thin evidence.
Output Format
- Structure: Scored components in a compact block, followed by the one-paragraph risk summary
- Length: 180–300 words total
- Format: Labeled score lines + a scoring calculation line + a single-paragraph summary
- Sections: Scoring Framework → Likelihood (score + driver) → Impact (score + driver) → Risk Score & Severity Tier → Recommended Treatment → Risk Summary paragraph
- Tone: Risk manager voice — precise, evidence-anchored, decisive; no hedging on the final tier
Quality Checklist
Before delivering output, verify:
- [ ] Likelihood and impact are each scored 1–5 with a stated driver, not a bare number
- [ ] Risk Score is shown as an explicit Likelihood × Impact calculation
- [ ] Severity tier matches the score band in the matrix (no manual override without stated rationale)
- [ ] Exactly one primary treatment action is recommended, with a concrete first step
- [ ] The scoring framework used (NIST 800-30 or ISO 27005) is named
- [ ] Any assumptions made under thin evidence are flagged in the summary
Notes
- When multiple impact dimensions apply, always score the worst case — averaging masks the risk that actually matters.
- If existing controls are strong, reduce likelihood rather than impact; controls rarely change the consequence of a successful event, only its probability.
- Round up when evidence is ambiguous — under-scoring a real risk is more costly than over-scoring a minor one, and the flagged assumption gives reviewers a clear place to challenge.
- The score is a prioritization tool, not a substitute for a full risk assessment — treat Critical and High tiers as triggers for deeper analysis.
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills