Managing Baseline Findings in EBIOS Risk Manager

This guide outlines a structured approach for managing baseline findings within the EBIOS Risk Manager framework. It aims to transform baseline security non-compliances into actionable inputs for risk analysis. The document begins by defining key concepts such as risk, non-compliance, and security baseline, providing clarity on how these terms relate to the overall risk management process. It details a four-step operational approach that includes identifying non-compliances, analyzing their exploitability, developing operational scenarios, and consolidating measures into a risk treatment plan. The guide emphasizes the importance of a scenario-based approach to avoid the compliance tunnel effect, which can obscure the understanding of risks. It also discusses the need to link security measures to risk scenarios to ensure effective prioritization and justification of actions. The conclusion reinforces that all relevant measures must be documented in the Risk Treatment Plan, ensuring that they are connected to identified risks.