controls lessen the probability of vulnerability exploitation The capability of the threat is high, and Between 10 and 100 times compensating controls to reduce the Likely (L) 3 per year probability of vulnerability exploitation are insufficient The capability of the threat is significant, and compensating controls Highly Likely (HL) 4 to reduce the probability of >100 times per year vulnerability exploitation are insufficient Control Effectiveness Rating Control Rating Effectiveness of Control Consideration Effectiveness Low - Ineffective Does not reduce the frequency and Only protects Controls severity of the threat(s) against bottom 1 10% of an average threat population Medium - Reduces the frequency and severity Only protects Moderately of the threat(s) moderately against bottom 2 effective controls effectively 40% of an average threat population High - Effective Reduces the frequency and severity Protects against all Controls of the threat(s) effectively but the top 40% of 3 an average threat population Very High Highly Reduces the frequency and severity Protects against all – Effective Controls of the threat(s) highly effective but the top 10% of 4 an average threat population Cost of Control Rating Threat Likelihood Rating Consideration Direct Cost: Negligible cost to organization (Less than QAR 100K) Low 1 Indirect Cost: No impact on system performance and employee morale Direct Cost: Moderate cost to organization (QAR 100K-QAR 500K) Medium 2 Indirect Cost: impact on system performance and employee morale e.g. system performance reports, employee complaints etc… High 3 Direct Cost: High cost to organization (QAR 500K-QAR 1M)
controls lessen the probability of vulnerability exploitation Likely (L) 3 The capability of the threat is high, and compensating controls to reduce the probability of vulnerability exploitation are insufficient Between 10 and 100 times per year Highly Likely (HL) 4 The capability of the threat is significant, and compensating controls to reduce the probability of vulnerability exploitation are insufficient >100 times per year Control Effectiveness Rating Control Effectiveness Rating Effectiveness of Control Consideration Low - Ineffective Controls 1 Does not reduce the frequency and severity of the threat(s) Only protects against bottom 10% of an average threat population Medium - Moderately effective controls 2 Reduces the frequency and severity of the threat(s) moderately effectively Only protects against bottom 40% of an average threat population High - Effective Controls 3 Reduces the frequency and severity of the threat(s) effectively Protects against all but the top 40% of an average threat population Very High – Highly Effective Controls 4 Reduces the frequency and severity of the threat(s) highly effective Protects against all but the top 10% of an average threat population Cost of Control Rating Threat Likelihood Rating Consideration Low 1 Direct Cost: Negligible cost to organization (Less than QAR 100K) Indirect Cost: No impact on system performance and employee morale Medium 2 Direct Cost: Moderate cost to organization (QAR 100K-QAR 500K) Indirect Cost: impact on system performance and employee morale e.g. system performance reports, employee complaints etc… High 3 Direct Cost: High cost to organization (QAR 500K-QAR 1M)