Risk Extension

[DPV] provides a minimal set of risk assessment concepts that include dpv:RiskAssessment dpv:Risk, dpv:RiskMitigation, dpv:Severity, dpv:Likelihood, dpv:Consequence, and dpv:Impact along with relations or properties to use them. To further assist tasks and representation of information regarding risk assessments, as well as to support the implementation of risk management, the [RISK] extension provide additional concepts and taxonomies through which risks and impacts can be defined - such as to describe incidents, data breaches, their associate reports and notices, risk matrices, and other risk management processes.

The RISK extension utilises the following sources to guide and define its concepts and taxonomies:

1. ISO 31000 series, which includes:
   1. ISO 31073:2022 Risk management — Vocabulary
   2. ISO 31000:2018 Risk management — Guidelines
   3. IEC 31010:2019 Risk management – Risk assessment techniques
2. Requirements from regulations to perform risk and impact assessments, which includes:
   1. General Data Protection Regulation (GDPR)
   2. Network Information Security Directive (NIS2)
   3. Artificial Intelligence Act (AI Act)

The core concepts involves reuse of the following concepts from [DPV]:

• dpv:Risk represents the concept of 'risk' i.e. a possibility or potential of negative events to occur, and is indicated using the relation dpv:hasRisk.
• dpv:RiskMitigationMeasure represents a method or process or control to mitigate the risk, and is associated using the relation dpv:isMitigatedByMeasure
Note: Risk Mitigation and Risk Treatment
• dpv:Consequence represents the consequences of risks and incidents, and is associated using the relation dpv:hasConsequence. To indicate who or what the consequence affects, the relation hasConsequenceOn is used. The [RISK] extension provides a taxonomy of consequences and impacts.
• dpv:Impact represents the impacts of the risks and incidents on entities, and is associated using the relation dpv:hasImpact. To indicate who the impact affects, the relation hasImpactOn is used.
Note: Consequences and Impacts
• dpv:Severity represents the severity of risks and incidents, and is indicated using dpv:hasSeverity.
• dpv:Likelihood represents the likelihood of risks and incidents, and is indicated using dpv:hasLikelihood.
• dpv:RiskLevel represents the level of risks and incidents, and is indicated using dpv:hasRiskLevel. The [RISK] extension provides a taxonomy of risk levels.

The new concepts introduced in this extension include the following:

• Incident to represent an actual occurence of the risk i.e. to indicate a risk has materialised, which is associated with the risk with relation refersToRisk. To associate an incident with a context, such as a process or a system, the relation hasIncident is provided.
• IncidentStatus to indicate the state or status of an incident, such as whether it is ongoing or has concluded. It is associated using the relation dpv:hasStatus.
• RiskSource to represent the source or origin of risk, which is indicated using hasRiskSource.
• Threat is a RiskSource which causes the risk, and is indicated by the relation causedByThreat.
• ThreatSource is the agent or non-agent cause of the Threat, and is indicated by the relation hasThreatSource.
• Vulnerability to describe the weakness of a process, system, or entity, which is exploited by the ThreatSource in a Threat event to give rise to risk and cause an incident. Vulnerability is associated using the relation hasVulnerability, and the relation isVulnerabilityOf indicates what the vulnerability is associated with.
• The relation exploitsVulnerability indicates a Threat exploits a Vulnerability, and the relation isExploitedBy indicates how a Vulnerability is associated with a Threat. The relation causedByVulnerability indicates an incident is caused by a vulnerability.
• RiskControl to represent specific controls used in risk mitigation such as changing likelihoods or removing the risk source. The relation hasControl is used to associate them.
• RiskMatrix to represent the popular risk analysis method for calculating risk levels based on likelihood and severity.

To express likelihoods, severities, and levels in a convenient manner, the RISK extension provides the following groups of concepts. Each concept is associated with a suggested value to represent the extent or degree of the concept between 0..1 using rdf:value e.g. ExtremelyLowRisk has a value of 0.01 and HighLikelihood has a value of 0.75. Each group uses these values to express a range within a group e.g. in 3LikelihoodLevels the LowLikelihood (0.25) covers the range 0 to 0.25, while in 7LikelihoodLevels it covers the range from 0.1 (VeryLowLikelihood) to 0.25. Adopters can thus choose the appropriate ranges, and as the values are suggestions - they can be changed to match the requirements of the use-case.

• Likelihood:
  • 3LikelihoodLevels which contains 3 likelihood levels of HighLikelihood (0.75), ModerateLikelihood (0.5), and LowLikelihood (0.25)
  • 5LikelihoodLevels which contains the 3 likelihood levels from 3LikelihoodLevels as well as VeryHighLikelihood (0.9) and VeryLowLikelihood (0.1)
  • 7LikelihoodLevels which contains the 5 likelihood levels from 5LikelihoodLevels as well as ExtremelyHighLikelihood (0.99) and ExtremelyLowLikelihood (0.01)
• Severity:
  • 3SeverityLevels which contains 3 Severity levels of HighSeverity (0.75), ModerateSeverity (0.5), and LowSeverity (0.25)
  • 5SeverityLevels which contains the 3 Severity levels from 3SeverityLevels as well as VeryHighSeverity (0.9) and VeryLowSeverity (0.1)
  • 7SeverityLevels which contains the 5 Severity levels from 5SeverityLevels as well as ExtremelyHighSeverity (0.99) and ExtremelyLowSeverity (0.01)
• RiskLevel:
  • 3RiskLevels which contains 3 RiskLevel levels of HighRisk (0.75), ModerateRisk (0.5), and LowRisk (0.25)
  • 5RiskLevels which contains the 3 RiskLevel levels from 3RiskLevels as well as VeryHighRisk (0.9) and VeryLowRisk (0.1)
  • 7RiskLevels which contains the 5 RiskLevel levels from 5RiskLevels as well as ExtremelyHighRisk (0.99) and ExtremelyLowRisk (0.01)

To represent details about an Incident such as what personal data was involved, what technical measures were present before the incident occured, who were data subjects involved, and other pertinent details, the [DPV] concepts and relations should be reused.

To indicate the duration of the incident, the [DPV] concept dpv:Duration and relation dpv:hasRelation can be used, or dct:temporal from [DCT] can be used, or other means such as the [TIME] ontology or XSD types. If this information is unknown, then dpv:NotAvailable should be used. If the incident is ongoing, only the start would be available (also see IncidentStatus).

To indicate whether the incident is ongoing or concluded (on its own) or it was terminated due to some action taken, the concept IncidentStatus is provided along with a taxonomy of statuses which are indicated using the relation dpv:hasStatus.

RiskControl allows expressing how [DPV] technical and organisational measures address the risk or incident. They are associated using the relation hasControl. For example, ConsequenceControl is applied to consequences and impacts to either change them (ChangeConsequence) such as by reducing their likelihood or severity, or removing them (RemoveConsequence) completely. MonitorControl represents controls used to monitor events or effectiveness, such as to detect impacts (MonitorImpact) or identify vulnerabilities (MonitorVulnerabilities).

The RISK extension provides a taxonomy to expand upon the [DPV] concepts of dpv:Consequence and dpv:Impact. In [DPV], consequence is in general an outcome of an event, while impacts are a specific subset of consequences which affect entities (as compared to systems and technologies). The intent of this distinction is to support regulatory requirements such as impact assessments which are focused on how processes affect entities such as individuals and societal groups.

Broadly, the taxonomy is based on the following commonly required concepts:

1. Consequences:
   1. Benefit
   2. Detriment
   3. Damage
2. Impacts:
   1. MaterialDamage
   2. NonMaterialDamage
   3. Harm
   4. Compensation
   5. Reward
   6. Payment
   7. Fee
   8. Renumeration

Risk Matrix is a popularly used technique for qualitative risk analysis, through which a risk's likelihood and severity are used to obtain an overall risk level. To support its use, the RISK taxonomy provides concepts representing risk matrices of the format 3x3, 5x5, and 7x7. The concepts are expressed as combinations of Severity (Sx) and Likelihood (Lx) levels, and the resulting Risk Level (Lx) being used as its label. For example, the concept RM3x3S1L3 represents a node in a 3x3 matrix with Severity and Likelihood level low (n=1) and Likelihood level high (n=3) with a resulting Risk Level of 'Moderate'. Similarly, RM7x7S4L7 represents a node in a 7x7 risk matrix with Severity level moderate (n=4) and Likelihood level extremely high (n=7) with the resulting Risk Level of 'Very High Risk'.

It is possible to change the risk levels for the risk matrix by replacing the supplied labels with a custom one. For example, to indicate that the concept RM3x3S1L3 should be 'Low Risk' instead of 'Moderate'.