risk_scenario

ArchiMate / Open Group Equivalent: Risk Scenario / Assessment Element (Security Architecture Aspect)

Represents a comprehensive risk scenario detailing inherent risk, residual risk, and risk treatment strategies across the architecture.

Visual Styling

To apply custom styles or icons to risk scenarios, use a Style Rule (e.g. style risk_scenario where residual_rating == "Low" { icon "shield-check" }).

---

Syntax

risk_scenario <id> "<Display Name>" {
    description "<text>"
    owner "<risk_officer>"
    tags ["tag1", "tag2"]
    inherent_likelihood "<rating>"
    inherent_impact "<rating>"
    inherent_rating "<rating>"
    residual_likelihood "<rating>"
    residual_impact "<rating>"
    residual_rating "<rating>"
    treatment "Mitigate" | "Accept" | "Transfer" | "Avoid"

    relationships { ... }
}

---

Properties

Property	Type	Allowed Values	Description
description	string	Free text	Comprehensive risk scenario narrative
owner	string	Free text	Operational risk owner
tags	string[]	Array of strings	Categorization tags
inherent_likelihood	string	e.g. "High", "Medium"	Likelihood before controls
inherent_impact	string	e.g. "Critical", "High"	Impact before controls
inherent_rating	string	e.g. "Critical", "High"	Overall unmitigated risk score
residual_likelihood	string	e.g. "Low"	Likelihood after control implementation
residual_impact	string	e.g. "Medium"	Impact after control implementation
residual_rating	string	e.g. "Low"	Post-mitigation residual risk score
treatment	enum	"Mitigate", "Accept", "Transfer", "Avoid"	Risk treatment decision

---

Allowed Relationship Verbs & Targets

Verb	ArchiMate / Security Relation	Allowed Target Entity Types
targets	Exploitation	capability, process, system, app, component, infrastructure, data_object, actor, agent, trust_boundary
governed_by	Governance	policy, standard

---

Complete Example

risk_scenario risk_ransomware_outage "Ransomware Infiltration & Outage" {
    description "Supply chain compromise leading to lateral malware movement and encrypted databases"
    owner "Chief Risk Officer"
    inherent_likelihood "Medium"
    inherent_impact "Critical"
    inherent_rating "Critical"
    residual_likelihood "Low"
    residual_impact "Medium"
    residual_rating "Low"
    treatment "Mitigate"

    relationships {
        this targets sys_core_banking "Threatens banking availability"
        this governed_by pol_enterprise_risk
    }
}