Risk assessment
Set a product's business criticality with the risk assessment questionnaire or by hand.
Business criticality says how much damage an attack on a product would do, from 0 to 100. Portal multiplies the product’s risk by it, so the same findings weigh more in a critical product. See WRT.
A new product starts at 100: until someone assesses it, Portal treats it as the most critical. Set its criticality with the questionnaire, or by hand.
Answer the questionnaire
Open the product and click Risk Assessment in the sidebar. Answer each question: every answer has a score from 0 to 90, shown next to it.
Even the most critical answers give at most 90, not 100. A product whose risks you have assessed is a little less risky than one that nobody has looked at, which keeps the 100 it started with.
The questions below come with Portal and suit most products. An administrator can replace them, their answers and scores with your own in the admin panel. The default questions ask:
- How much the product affects the company revenue.
- How bad a day of downtime would be.
- What users can do in it: read or edit data, sensitive or not, or start paid actions.
- Whether it integrates with internal services, and what those integrations can reach.
- The same for external services.
- Which scenarios the product owners fear most.
- What data it stores.
- Whether it contains financial logic.
The business criticality is the average score of all questions, rounded to 10. A question without an answer counts as 0. Click Submit to save the answers and set the criticality.
Answer together with the product owner: they know the business impact better than the security team.
Set it by hand
On the product’s page, click a value on the Business Criticality scale. Portal offers to Take the test instead; click Set manually to keep the value you clicked.
The date under the scale shows when the criticality last changed.