EBIOS RM cheatsheet

Element	Description	Examples
Objective	Define the framework of the study, its business and technical scope, the feared events and the security baseline	-
Inputs	Org context, missions, existing policies, IS architecture, mapping of the IS	Org charts, network diagrams
Outputs	Framework elements (objectives, roles, timeframe) + business assets + supporting assets + feared events (FE) with severity + security baseline with gaps	Risk context document
Deliverable	Scope + BA/SA (VM/BS) + FE (ER) with severity + security baseline (gaps identification)	Scope doc, baseline compliance ref

Business Assets (Valeurs métier / VM):

Type	Examples
Business processes	Order processing, accounting, production, HR
Sensitive information	Customer data (GDPR), intellectual property, trade secrets
Digital components	Critical business software, source code, databases

Supporting Assets (Biens supports / BS):

Category	Examples
Systems	Servers, workstations, IoT, SCADA
Networks	LAN, WAN, VPN, cloud, OT links
Software	ERP, CRM, OS, firmware
People	Administrators, contractors, privileged users
Premises	Datacenter, offices, network cabinets

Element	Description
Objective	Identify risk origins (RO) and their target objectives (TO), assess and select the most relevant RO/TO pairs
Inputs	Missions and business assets (W1), threat intelligence, OSINT
Outputs	Selected RO/TO pairs (representative, not exhaustive), mapping of risk origins
Deliverable	List of priority RO/TO pairs with motivation/resources/activity assessment

Risk Origin (Source de Risque)	Target Objective (Objectif Visé)	Motivation	Resources
State-sponsored APT	Strategic espionage	Geopolitical	Very high
Organised cybercriminal	Ransomware / extortion	Financial	High
Malicious competitor	IP theft / sabotage	Competitive	Medium
Malicious insider	Sabotage / internal leak	Revenge / corruption	Low - high
Hacktivist	Defacement / DDoS / leak	Ideological	Variable
Script kiddie	Opportunistic	Notoriety	Low

Assessing an RO/TO pair (SR/OV):

• RO's motivation to reach the TO
• Available resources (financial, technical, human)
• Recent documented activity (CTI, past incidents)
• Retain only relevant pairs (3 to 6 RO/TO pairs generally suffice according to the ANSSI guide)

Element	Description
Objective	Obtain a clear view of the ecosystem, identify critical stakeholders, build strategic scenarios (attack paths from RO to business assets via stakeholders)
Inputs	RO/TO pairs (W2), ecosystem mapping, feared events (W1)
Outputs	Ecosystem digital threat mapping, strategic scenarios with severity, security measures on the ecosystem
Deliverable	Ecosystem threat mapping + strategic scenarios (attack graphs) + ecosystem security measures

Ecosystem Mapping - Stakeholders (Parties Prenantes):

Stakeholder (Partie Prenante)	Dependency (0-4)	Trust (0-4)	IS Penetration
Cloud providers (AWS, Azure)	4	3	Direct - admin
IT service providers / managed services	4	2	Direct - admin
Customers with portal access	3	3	Indirect
Partners (network interconnection)	3	3	Direct
Subcontractors (physical access)	2	2	Physical / logical
Software vendors (updates)	3	3	Indirect - supply chain

Stakeholder assessment (official ANSSI method):

The ANSSI guide distinguishes two assessment axes:

Axis	Criteria	Description
Exposure	Dependency + Penetration	Degree of dependency of the organisation on the stakeholder, and level of access the stakeholder has to the IS
Cyber reliability	Maturity + Trust	Security level of the stakeholder (audits, certifications) and trust granted to the stakeholder

Criterion	Description	Impact on risk
Dependency (Dépendance)	Degree of dependency of the organisation on this stakeholder	The higher the dependency, the greater the impact of a compromise
Penetration	Level of access the stakeholder has to the organisation's IS	The deeper the penetration, the shorter the attack path
Maturity (Maturité)	Security level of the stakeholder (audits, certifications)	The lower the maturity, the more likely the stakeholder is a target
Trust (Confiance)	Level of trust granted to the stakeholder	Inversely proportional to the threat: low trust = high risk

Stakeholder exposure = Dependency x Penetration / Maturity. Stakeholders with high exposure and low cyber reliability (maturity + trust) are the priority strategic vectors. The ANSSI guide (methodological sheet no. 5) recommends mapping stakeholders into zones: Watch, Control, Danger.

Building a strategic scenario:

[Risk Origin]
       |
       | via strategic attack path
       v
[Ecosystem Stakeholder] <-- or direct attack
       |
       v
[Business Asset] --> [Feared Event]

Examples:
RO: Cybercriminal  -> Stakeholder: IT provider (weak security) -> BA: Production IS -> FE: Unavailability (ransomware)
RO: State APT      -> Stakeholder: Software vendor (supply chain) -> BA: R&D -> FE: IP disclosure
RO: Malicious insider -> Direct access -> BA: Customer DB -> FE: Data leak (GDPR)

Element	Description
Objective	Build operational scenarios (methods of attack on supporting assets) and assess their likelihood. Create a summary of all risks
Inputs	Strategic scenarios (W3), IS architecture (application and infrastructure mapping), security baseline (W1), RO/TO pairs (W2)
Outputs	Operational scenarios with overall likelihood assessment
Deliverable	Operational scenario diagrams (attack graphs) + likelihood assessment per scenario

Strategic to operational decomposition:

Strategic scenario (W3):
  Cybercriminal -> IT provider -> Production IS -> Unavailability

Operational scenarios (W4):
  OS1: Provider phishing -> credential theft -> internal RDP -> ransomware deployment
  OS2: Provider VPN CVE exploitation -> LAN pivot -> server encryption
  OS3: Supply chain: backdoored provider software -> C2 -> lateral movement
  OS4: MFA bypass (SIM swap) provider -> O365 access -> prod cloud access

For each OS: sequence of elementary actions + targeted supporting assets + likelihood

Assessing the likelihood of an operational scenario:

Begin by assessing the elementary likelihood of each elementary action. Then assess the overall likelihood of the scenario. The assessment can focus on the method of attack of least effort for the risk origin (per ANSSI guide p.63, methodological sheet no. 8).

Action difficulty (Difficulte)	Corresponding likelihood (Vraisemblance)
Elementary (public tools, script kiddie)	V4 - Nearly certain (Maximale)
Moderate (technical skills, specific tools)	V3 - Very likely (Forte)
Difficult (advanced expertise, significant resources)	V2 - Likely (Significative)
Very difficult (state capabilities, 0-day)	V1 - Rather unlikely (Minime)

Sequence of elementary actions (MITRE ATT&CK TTPs):

Note: The ANSSI EBIOS RM guide references the Lockheed Martin cyber kill chain model (p.58) but does not explicitly mention MITRE ATT&CK. The mapping below is a commonly used practitioner enrichment.

Phase Kill Chain	Action	TTPs MITRE
Reconnaissance	OSINT, scan, harvesting	T1598, T1591, T1592
Initial Access	Phishing, public exploit, supply chain	T1566, T1190, T1195
Execution	Script, macro, interpreter	T1059, T1204
Persistence	Backdoor, scheduled task, service	T1053, T1543, T1547
Privilege Escalation	Local exploit, token impersonation	T1068, T1134
Lateral Movement	Pass-the-hash, RDP, WMI	T1550, T1021, T1047
Collection	Keylogging, screen capture, data staged	T1056, T1074
Exfiltration	Data theft (C2, cloud)	T1041, T1048, T1567
Impact	Encryption, sabotage, wipe	T1486, T1485, T1491

Element	Description
Objective	Create a summary of risk scenarios, define a risk treatment strategy, identify residual risks, set up monitoring framework
Inputs	Security baseline (W1), strategic scenarios + ecosystem measures (W3), operational scenarios (W4)
Outputs	Risk treatment strategy, summary of residual risks, SCIP, framework for monitoring risks
Deliverable	Risk treatment strategy + SCIP (Security Continuous Improvement Plan / PACS) + summary of residual risks + framework for monitoring risks

Risk acceptability classes (official ANSSI):

Risk level	Acceptability	Actions (PDF)
Low	Acceptable as is	No action is to be undertaken
Moderate	Tolerable under control	Follow-up in risk management, actions set up in the framework of continuous improvement over the medium and long term
High	Unacceptable	Measures for reducing the risk must absolutely be taken in the short term. Otherwise, all or a portion of the activity will be refused

Treatment strategies (ISO 27005 / practitioner):

Strategy	Description	When to use
Reduce (Reduire)	Implement security measures (technical + organisational)	High risk, acceptable ROI
Refuse / Avoid (Refuser / Eviter)	Stop or do not start the risky activity	Unacceptable risk, no proportionate measure available
Transfer (Transferer)	Cyber insurance, secured outsourcing	Residual risk financially transferable
Accept (Accepter)	Accept the residual risk after measures	Low risk, or treatment too costly vs impact

Note: The ANSSI EBIOS RM guide defines three acceptability classes (acceptable, tolerable, unacceptable). The four treatment strategies (reduce, refuse, transfer, accept) come from ISO 27005 and are commonly used as a complement.

Risk dashboard (example):

Scénario	RO	Severity	Likelihood	Gross Risk	Measures	Residual Risk	Decision
Ransomware via provider	Cybercriminal	4	3	Critical	EDR, segmentation, MFA, third-party audit	Medium	Reduce
APT supply chain espionage	State-sponsored	4	2	High	ANSSI hardening, SBOM, integrity checks	Medium	Reduce
Insider data leak	Internal	3	2	Medium	DLP, PAM, logging, awareness	Low	Reduce
Web defacement	Hacktivist	2	2	Low	WAF, monitoring	Low	Accept

Terme FR (abrev.)	English Term (abrev.)	Definition
Valeur métier (VM)	Business asset	Important component for the organisation accomplishing its mission (process, information, know-how)
Bien support (BS)	Supporting asset	Component of the information system on which one or several business assets are based (digital, physical or organisational)
Événement redouté (ER)	Feared event (FE)	Event associated with a business asset that harms a security need (availability, integrity, confidentiality, traceability)
Source de risque (SR)	Risk origin (RO)	Element, person, group of persons or organisation that can generate a risk, characterised by its motivation, resources, and skills
Objectif visé (OV)	Target objective (TO)	End purpose targeted by a risk origin, according to its motivations
Couple SR/OV	RO/TO pair	Pairing of a risk origin with its specific target objective
Scénario stratégique	Strategic scenario	Attack paths going from a risk origin to a target objective, including the ecosystem and business assets. Assessed in terms of severity
Scénario opérationnel (SO)	Operational scenario	Chain of elementary actions regarding the supporting assets. Assessed in terms of likelihood
Chemin d'attaque	Attack path	Sequence of elementary actions to reach a target objective
Vraisemblance	Likelihood	Estimation of the feasibility or probability that a risk occurs (scale V1-V4)
Gravité	Severity	Estimation of the extent and intensity of the effects of a risk (scale G1-G4)
Socle de sécurité	Security baseline	Implementation status of applicable reference standards, with gaps identified
Plan de traitement du risque (PTR)	Risk treatment strategy	Formalises the acceptance thresholds and level of security to be achieved for each risk
PACS / PASC	Security continuous improvement plan (SCIP)	Formalises all measures for treating the risk, scheduled over time. Favours elevating IT system security maturity
Partie prenante	Stakeholder	Element with direct or indirect interaction with the studied object (internal or external)
Risque résiduel	Residual risk	Risk scenario remaining after application of the risk treatment strategy
Niveau de risque	Risk level	Measurement of the extent of the risk, expressed by combining severity and likelihood
Objet de l'étude	Studied object	Organisation, information system or product that is the object of the risk assessment

The security baseline (W1) compares the current state of security against applicable reference frameworks. The ANSSI guide (p.28) mentions three generic categories: ANSSI best practices/guides, ISO 27000 family, and applicable regulations.

Framework	Applicability	Description
ANSSI Guide d'hygiene informatique	All organisations	42 essential security measures - the minimum baseline for any EBIOS RM study
ANSSI Hardening guides	Per technology	AD hardening, Linux, Windows, cloud, DNS, TLS, Wi-Fi, etc.
ANSSI Active Directory guide	AD environments	Specific hardening recommendations for Active Directory (tiering, admin stations, GPO)
ISO 27002:2022	International	93 organisational and technical controls - commonly used for gap analysis
RGS (Referentiel General de Sécurité)	French public administrations	Mandatory security rules for government IS
PSSIE	French state entities	State information systems security policy
NIS2 / LPM	Essential and important entities (EU)	Regulatory obligations for critical infrastructure operators
SecNumCloud	Cloud providers in France	ANSSI security qualification for cloud services
II 901	Classified information (France)	Protection of sensitive and classified IS
HDS (Health Data Hosting)	Health sector	Certification for hosting personal health data

Note: The ANSSI guide does not prescribe specific frameworks. The table above lists commonly used references in French EBIOS RM studies. Adapt to your sector and regulatory context.

EBIOS RM produces security measures at three distinct levels:

Source	Type of measures	Examples
W1 - Security baseline	Compliance measures (framework gaps)	RGS compliance, hardening per ANSSI guides, password policy, traffic encryption
W3 - Ecosystem	Measures on stakeholders	Contractual security clauses, supplier audits, third-party access segmentation, provider security assurance plan
W5 - Treatment	Measures specific to identified risks	EDR/XDR against ransomware, DLP against data leaks, PAM against lateral movement, SBOM against supply chain

Important: Baseline security measures (W1) are prerequisites independent of the risk analysis. W3 and W5 measures are specific to risks identified by the study.

Role	Responsibility	Workshop presence
Sponsor / Executive management	Validates the scope, defines risk appetite, accepts residual risks	W1 (kick-off), W5 (validation)
CISO / Risk manager	Leads the study, coordinates workshops, consolidates deliverables	W1-W5 (all)
EBIOS RM facilitator	Facilitates workshops, masters the methodology, guides participants	W1-W5 (all)
Business / Process owners	Identify business assets, assess feared event severity, validate strategic scenarios	W1, W3, W5
CIO / IS architects	Provide supporting asset mapping, validate technical feasibility of measures	W1, W3, W4, W5
CTI / SOC team	Feed threat intelligence, validate RO/TO (SR/OV) pairs and operational scenarios	W2, W4
DPO	Identifies GDPR constraints, validates feared events on personal data	W1, W5
Risk owners	Formally accept residual risks assigned to their scope	W5

The security baseline is assessed against frameworks applicable to the organisation's context. The ANSSI guide (p.28) cites three generic categories: ANSSI rules and best practices, ISO 27000 standards, and applicable regulations. The specific frameworks below are common examples:

Framework	Applicability	Description
RGS (Referentiel General de Sécurité)	French administrations, public service operators	Security rules for administrative authorities' information systems
PSSIE	State administrations	State information systems security policy
NIS2 / LPM	OIV, OSE, essential and important entities	Security obligations and incident notification
SecNumCloud	Cloud providers handling sensitive data	ANSSI qualification for cloud service providers
II 901	Systems handling classified information (DR, SD, CD)	Interministerial instruction no. 901
ISO 27002:2022	Any organisation	93 reference security measures
ANSSI hardening guides	Any organisation	Technical recommendations for AD, Linux, cloud, workstations, remote work
HDS	Health data hosting providers	Certification for health data processing

Baseline assessment method: For each requirement of the applicable framework, assess the compliance level (compliant / partially compliant / non-compliant / not applicable) and document the gaps. Gaps directly feed the security measures to implement.