Change Management Risk Quantification

See how a proposed change alters cyber risk and financial exposure, then test controls until the future state is ready to approve.

38Before risk

76Projected risk

+38Risk delta

Before

Risk score/ 100

Financial exposure$1.9M

Remote accessNo

Trust boundaryBlocked

Change Risk Delta

+38

Risk increased

Exposure delta+$3.5M

Exposure change+184%

Review required

After

Projected risk/ 100

Financial exposure$5.4M

Remote accessYes

Trust boundaryNew vendor path

Model the proposed change

Only inputs that materially change the future state are used in this comparison.

Change title Change category Asset criticality Hourly operational value ($) Credible outage duration (hours) Internet exposure Remote access Security control maturity External dependencies Baseline risk override (optional) Baseline exposure override ($, optional) Change risk points Exposure multiplier

Calculated baselineRisk and exposure are calculated from the current-state facts above.

Proposed controls Require MFAReduce account compromise probability. Use a jump hostKeep vendor access outside the OT trust boundary. Restrict source IP and maintenance windowReduce reachability and duration of exposure. Enable IDS monitoringImprove detection and response readiness. Test rollback and validate backupsReduce recovery and execution risk.

Change Management Risk Quantification

Before i

Change Risk Delta i

After i

Model the proposed change i

Before

Change Risk Delta

After

Model the proposed change