# Risk Scores
- Source: https://support.icompaas.com/support/solutions/articles/62000225202-risk-scores
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CyberSecurity Taxonomy](https://support.icompaas.com/support/solutions/62000112345) › [CyberSecurity-Topics](https://support.icompaas.com/support/solutions/folders/62000168169)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)
**Risk Analysis Policy -** **Risk Management**
## **Risk Scores:**
A risk score is a computed number (score) that expresses how serious a risk is given certain circumstances. Probability and effect are often multiplied to determine project risk ratings, while other variables, such as weighting, may also be taken into account. Risk scores are often produced for qualitative risk assessment utilising variables based on probability and effect distributions. Risk probability and effect inputs in quantitative risk assessments might be discrete numbers or statistical distributions.
Ranges of Risk Probability:
The likelihood that a specific event may occur during a project is known as risk probability. For instance, there are five categories of probability: Very Low, Low, Medium, High, and Very High. These categories have the drawback of being extremely vague and having many interpretations depending on who you ask. The use of categories like Rare, Unlikely, Possible, Probable, and Certain in certain ways makes an attempt to ameliorate this, but it still begs the question of what these labels truly represent.
## Risk Impact Ranges:
Assessing affects may be difficult, just as using probability matrices, if there is no agreed-upon description of what each impact level signifies. Additionally, risk implications can have an influence on several project goals, including budget, time, safety, quality, and others. These may each be evaluated separately and are referred to as risk categories.
We aim to give a uniform definition for each risk category to support the evaluation.
Label
Cost
Schedule
Safety
Very Low
< 1%
1 day
Non injury accident
Low
1-5%
< 1 week
Requires medical attention
Medium
6-10%
2 weeks
Requires hospitalization
High
11- 20%
1 month
> 1 day work lost
Very High
> 20%
> 1 month
> Fatality
## Related compliance guidance
- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.