Supporting Document: Risk Matrix Template
How to rate risks
Use simple school-appropriate risk ratings.
| Rating | Likelihood meaning | Impact meaning |
|---|---|---|
| Low | Unlikely or only possible in unusual conditions. | Minor inconvenience or easy fix. |
| Medium | Could happen during normal use or setup. | Noticeable problem, data exposure or system disruption. |
| High | Likely, easy to trigger or already observed. | Serious privacy, safety, security or trust issue. |
Priority guide
| Likelihood | Impact | Priority |
|---|---|---|
| High | High | High |
| High | Medium | High |
| Medium | High | High |
| Medium | Medium | Medium |
| Low | High | Medium |
| High | Low | Medium |
| Medium | Low | Low/Medium |
| Low | Medium | Low/Medium |
| Low | Low | Low |
Risk table
| Risk ID | Vulnerability | Type | Affected user/component | Likelihood | Impact | Priority | Mitigation |
|---|---|---|---|---|---|---|---|
| R1 | user/security/supply chain | ||||||
| R2 | user/security/supply chain | ||||||
| R3 | user/security/supply chain | ||||||
| R4 | user/security/supply chain | ||||||
| R5 | user/security/supply chain |
Example risks
| Example vulnerability | Type | Possible mitigation |
|---|---|---|
| User does not know what data is being logged. | privacy/user | Add clear notice and minimise logs. |
| Default or weak password on a controller. | security/user | Require stronger authentication and change defaults. |
| External library is outdated. | software supply chain | Check versions and update from trusted source. |
| Unknown cheap component has no documentation. | component supply chain | Use documented parts or record limitations. |
| App shows device state unclearly. | user/security | Improve labels and warnings. |
| Printed/mechanical part could fail around a moving garage door. | component/safety | Test fit, document limits and improve the design. |