Question - Risk aligned to C, I or A?

[eramba]

Reference to the other risk post were we discuss other risk methodologies:

Question - Risk Mg methodology: OCTAVE

I was just going to suggest FAIR or FAIR Basic. FAIR requires a Monte Carlo simulator which maybe a lot to ask of Eramba right now but that would be awesome. FAIR Basic is semi-quantitative and would probably fit in Eramba using the Very Low to Very High level classification. “Managing and Measuring Information Risk”" by Jack Freund is a great resource for both. FAIR is the OpenGroup approved method and is definitely becoming the new gold standard in information risk management.