Skip to main content

Performing Risk Assessments

While the CVSS score provides a standardized measure of a vulnerability's technical severity, a comprehensive Risk Assessment evaluates the actual business impact of the flaw within the context of your specific deployment environment. CVD Portal aligns product risk assessments with the normative 4-stage methodology of FprEN 40000-1-2 Clause 6.4 (RMA-03 to RMA-06):

  1. Asset Identification (RMA-03-RQ-01): Map software components, stored data, keys, and user safety assets.
  2. Threat Identification (RMA-04-RQ-01): Apply STRIDE threat modeling.
  3. Risk Analysis (RMA-05-RQ-01..03): Estimate impact severity and occurrence likelihood for each threat scenario.
  4. Risk Evaluation & Acceptance (RMA-06-RQ-01..04): Compare residual risks against pre-established acceptance criteria (RMA-02) and justify any accepted residual risks.

You do the risk assessment per product, in the product's assessment workspace. You record assets with a category and a classification, STRIDE threats against those assets, and a likelihood and an impact for each risk. The product risk assessment requires the Compliance plan.

For detailed standard clause guidance, see Clause 6.4 — Product Cybersecurity Risk Assessment.

These formal risk assessments are crucial for justifying remediation timelines, especially when choosing to delay a patch in favor of alternative mitigations. Each save of a product assessment writes an entry to the audit log. This provides a robust audit trail that demonstrates to regulators and stakeholders that your organization takes a deliberate, risk-based approach to vulnerability management.