AtelierRisk analysis, step by step

How it works

Atelier gives you a first look at your main risks. Here is what stands behind it.

The method

Atelier follows EBIOS Risk Manager, the risk analysis method published by ANSSI, the French national cybersecurity agency. ANSSI states that the method conforms with ISO/IEC 27005:2022.

The method page (ANSSI) · The guide (ANSSI)

Your four screens and the five workshops of the method

  1. About you is workshop 1: what matters to you and what you use.
  2. Risks that apply are workshops 2 and 3: who or what could cause each risk, and how.
  3. Now and after are workshops 4 and 5: how likely each risk is, what you already do and what you could add.
  4. Results are workshop 5: your risks on two maps, and the actions to start with.

It is a shorter form of the method, a first view rather than a full analysis.

Cloud infrastructure (servers, apps or data on a public cloud) is covered with the same method.

Where the numbers come from

  • The scales and the risk grid come from the ANSSI guide, version 1.5 (September 2024). The numbers are the guide's; only the names are in plain words.
  • The list of typical risks comes from two public sources: the ANSSI guide (risks caused on purpose) and NIST SP 800-30 (accidents, outages and mistakes).
  • The first suggestions for each risk and the confidence figure are simple Atelier rules that complete the method.

The scales, in plain words

How much it would matter

  1. Minor: a nuisance
  2. Noticeable: it weighs on you for a few days
  3. Serious: lasting damage or a high cost
  4. Very serious: the organisation would struggle to carry on

How likely: Unlikely, Possible, Likely, Very likely.

Level of the risk: Low, Moderate, High.

The grid crosses the two: the more it would matter and the more likely it is, the higher the level.

What the confidence figure means

It shows how much of the picture rests on your own answers rather than on typical values. Each answer adds to it, up to 75%. Confidence grows as you answer more questions yourself.

Your data

Your answers stay in a private space that only your browser can open. It is cleared after 30 days without a visit, and you can clear it yourself at any time with Delete my data. Download your results or the study file to keep a copy.

Independence

Atelier is an independent project, separate from ANSSI, SGDSN and Club EBIOS. EBIOS is a registered trademark of SGDSN.

Back to the home page