# Risk Scoring
URL: https://docs.autociso.io/console/iso/risk-scoring/
Description: This page is the detailed risk assessment workspace for a single asset. For each identified threat, you set likelihood and impact to calculate a risk score, then choose a treatment approach.

*This is the help text the console shows in the help panel on this page.*

This page is the detailed risk assessment workspace for a single asset. For each identified threat, you set likelihood and impact to calculate a risk score, then choose a treatment approach.

### Risk Score Calculation
**Risk Score = Likelihood × Impact** (both rated 1–5, yielding scores from 1–25). Scores are colored in the table:

- **1–7**: Low (green) — monitor and accept where appropriate.
- **8–14**: Medium (orange) — mitigate with standard controls.
- **15–25**: High (red) — treat as a priority. A warning appears at the top of the page when any risk scores 15 or more.

### Adding Threats
Click **Add Threat Manually** to fill in a threat name, likelihood, impact, treatment and notes; the score is calculated for you. Click **Generate AI Threats** to get suggestions instead.

### AI Suggestions
The **AI Threat Suggestions** panel lists plausible threats for the asset. Click **Accept** to add one [to the register](https://docs.autociso.io/console/iso/risk-register/), **Reject** to dismiss it, or **Dismiss all** to clear the list.

### Approval
Once the risks are scored and treatments chosen, click **Approve All Risks** ([Owners and Managers](https://docs.autociso.io/getting-started/roles-and-permissions/)). Each risk then shows an approval date in the **Approved** column; unapproved risks show Pending.

### ISO 27001 Requirement
ISO 27001 clause 6.1.2 requires defined likelihood/impact criteria and a chosen treatment option for each risk.

## Fields

### Threat Name

A concise description of the threat scenario.

**Examples:** `Unauthorized access via compromised admin credentials`, `Data exfiltration through a misconfigured cloud storage bucket`, `Ransomware via phishing email`.

### Likelihood (1–5)

How probable is this threat occurring?
- **1 (Rare)**: Unlikely given current controls.
- **2 (Unlikely)**, **3 (Possible)**: Could occur under typical conditions.
- **4 (Likely)**, **5 (Almost Certain)**: Expected to occur without intervention.

### Impact (1–5)

What is the business impact if this threat materializes?
- **1 (Negligible)**: Minimal disruption, no data loss.
- **2 (Minor)**, **3 (Moderate)**: Operational disruption, limited data exposure.
- **4 (Major)**, **5 (Catastrophic)**: Major breach, regulatory penalties, business continuity impact.

### Risk Treatment

The chosen approach for addressing this risk:
- **Mitigate**: Implement controls to reduce likelihood or impact.
- **Accept**: Acknowledge the risk without further action (requires justification).
- **Transfer**: Shift the risk to a third party (e.g., via insurance or contract).
- **Avoid**: Eliminate the activity that creates the risk.

### Treatment Notes

Describe the specific controls or actions planned to address this risk. This text becomes part of your ISMS documentation and will be reviewed by the auditor.