EBIOS Risk Manager
EBIOS RM · EBIOS · risk analysis method · ANSSI method · EBIOS workshops · risk scenarios
The French digital risk analysis method published by ANSSI, which starts from an organisation’s essential missions and plausible attackers to build risk scenarios and a treatment plan.
In practice
Published in 2018 by ANSSI, the French national cybersecurity agency, together with the Club EBIOS, the method was updated in 2024 (version 1.5) and aligned with ISO/IEC 27005:2022. It runs in five workshops: scope and security baseline, risk sources, strategic scenarios, operational scenarios, risk treatment. Its strength is to get business units, management and technical staff working together on concrete scenarios (“a competitor has our designs stolen through a subcontractor”) rather than an abstract list of threats. It is used in particular for the security accreditation of public systems, and ANSSI labels software that implements it.
Fictional case: a local authority runs the five workshops before putting its civil register online. The scenario judged most serious is not a direct attack but the compromise of the company hosting the application: the contract is renegotiated with security requirements and a right to audit.
