A risk matrix classifies risks by probability and impact, facilitating prioritization and treatment.
The risk matrix crosses occurrence probability with impact magnitude to classify risks into levels (low, medium, high, critical). Widely used in ISO 27001, ISO 31000 and ISO 22301 to prioritize treatment and allocate resources.
Depends on maturity. A 5x5 offers greater granularity. ISO 31000 does not prescribe a specific format.
ISO 27001 requires a risk assessment process but does not prescribe the tool. The matrix is most used but other methodologies are acceptable.
Need an assessment in this area?