I was just going to suggest FAIR or FAIR Basic. FAIR requires a Monte Carlo simulator which maybe a lot to ask of Eramba right now but that would be awesome. FAIR Basic is semi-quantitative and would probably fit in Eramba using the Very Low to Very High level classification. “Managing and Measuring Information Risk”" by Jack Freund is a great resource for both. FAIR is the OpenGroup approved method and is definitely becoming the new gold standard in information risk management.