Choose an assessment approach that fits the decision, available evidence and required level of precision. Document uncertainty whichever approach you use.
Risk can be assessed in various ways: quantitatively, qualitatively, or semi-quantitatively. Each approach has its advantages and disadvantages, and organizations choose based on their culture and attitudes towards uncertainty and risk communication.
Quantitative assessments
Quantitative assessments use numerical values, supporting cost-benefit analyses but requiring careful interpretation. Their quality and repeatability depend on the model, data, assumptions and treatment of uncertainty; numerical output alone does not make an assessment rigorous.
Qualitative assessments
Qualitative assessments use nonnumerical categories (e.g., low, medium, high) to communicate risk effectively. However, they have limited granularity, and different experts might produce varying results unless the categories are well-defined and annotated for consistency.
Semi-quantitative assessments
Semi-quantitative assessments combine aspects of both quantitative and qualitative methods, using bins, scales, or representative numbers. These assessments are easier for communicating risks to decision-makers and allow relative comparisons but require careful definition of scales to avoid ambiguity.
CSFaaS records categorical and numerical ratings through workspace-configured matrices. Explain what the selected labels and values mean before comparing assessments. A matrix rating is not automatically a calibrated probability or a monetary loss estimate.
(Source: NIST SP 800-30 Rev. 1)