The document describes the FIRM method for assessing risk, which considers the Frequency, Incident Response, Resilience, and Magnitude of potential events. It evaluates the probable Frequency of events occurring within a period that could result in loss, the organization's Incident Response plan to address events, the Resilience approaches like patching and hardening to prevent infiltration, and the potential Magnitude or monetary impact on the organization.

1. Using FIRM to assess risk
F
I R
M
F
I
R
M
Frequency of event(s) that is,
number of times the probable
frequency within a period that the
threat action will result in a loss.
#
Incident Response – Does the
organization has an incident
response plan to address event?
Resilience – What approach to
resilience does the organization has
to prevent infiltration of event? E.g.
patch Mgmt., hardening, etc.
Magnitude of event to the
organization after determining the
above factors, that is, the monetary
impact
$