{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43715,"path":"security-management/configuration-compliance/config-compliance-risk-calculator-example.md","title":"Examples for Configuration Compliance risk score calculation","bundle":null,"doc_type":null,"release":"australia","body":"\n# Examples for Configuration Compliance risk score calculation\n\nStarting with v13.0 of Configuration Compliance, you can customize the criteria for the default risk rule. Use risk scores provided by third-party vendors like Qualys and Tenable for risk score calculations.\n\nThird-party vendors, like Qualys and Tenable, provide their own scores. These scores are populated in the Criticality field on the sn\\_vulc\\_test table. Use this field for risk score calculations. To use this score to compute the risk score, follow the procedure:\n\n## Add source criticality as a criterion for a risk rule\n\nUse scores based on criticality provided by third-party vendors to compute risk scores.\n\n### Before you begin\n\nRole required: sn\\_vulc.admin\n\n### About this task\n\nThird-party vendors, like Qualys and Tenable, provide their own risk scores. These scores are populated in the Criticality field on the sn\\_vulc\\_test table. Use this field for risk score calculations and computing the risk score.\n\n### Procedure\n\n1.  Navigate to **All** &gt; **Configuration Compliance** &gt; **Administration** &gt; **Risk Calculators**.\n\n2.  Navigate to the Risk rule form.\n\n3.  Clear the **Active** check box, to deactivate the rule.\n\n4.  Click **Add Criteria**.\n\n5.  From the **Choose reference table** list, select **Test Result**.\n\n6.  From the **Field** list, select **Test.Criticality**.\n\n7.  In the **Weight** field, specify the relative importance of this field.\n\n    The value must be an integer from 0 through 100.\n\n8.  In the **Define Value Weightages** section, add field values, and assign a weightage percentage to the fields.\n\n    \\[Omitted image \"source-criticality-cc-risk-calculator.png\"\\] Alt text: Source Criticality for risk calculation\n\n9.  Click **Submit**.\n\n\n## Add business criticality as a criterion for a risk rule\n\nSpecify a criticality value to business services and use the business criticality to compute the risk scores.\n\n### Before you begin\n\nRole required: sn\\_vulc.admin\n\n### About this task\n\nAssuming your organization has many business services and a configuration item \\(CI\\) is being used by the following services:\n\n<table id=\"table_rsq_jy4_5sb\"><thead><tr><th>\n\nBusiness Service\n\n</th><th>\n\nCriticality\n\n</th></tr></thead><tbody><tr><td>\n\nCloud Management\n\n</td><td>\n\n1 - Most critical\n\n</td></tr><tr><td>\n\nE-commerce\n\n</td><td>\n\n2 - Somewhat critical\n\n</td></tr><tr><td>\n\nClient services\n\n</td><td>\n\n3 - Less critical\n\n</td></tr><tr><td>\n\nTravel and Expense\n\n</td><td>\n\n4 - Not critical\n\n</td></tr></tbody>\n</table>The mapping between the CI and services is stored in the Services \\[cmdb\\_ci\\_services\\] table. When a CI does not pass a Configuration Test, a Test Result \\(TR\\) is created. You can use the value of the business criticality from the affected services to compute the risk score for this TR. Follow the procedure to use the criticality value of these services to compute the risk score.\n\n### Procedure\n\n1.  Navigate to **All** &gt; **Configuration Compliance** &gt; **Administration** &gt; **Risk Calculators**.\n\n2.  Navigate to the Risk rule form from the **Calculator Rules** section.\n\n3.  Clear the **Active** check box, to deactivate the rule.\n\n4.  Click **Add Criteria**.\n\n5.  From the **Choose reference table** list, select **Configuration Item Reference Table**.\n\n6.  From the **Table** list, select **Service \\[cmdb\\_ci\\_service\\]**.\n\n7.  From the **Field** list, select **Business Criticality**.\n\n8.  In the **Aggregation** field, select **Minimum** to retrieve the most critical service for this use case \\(1- Most critical value\\) or **Maximum** to retrieve the least critical service for this use case \\(4 – Not critical value\\).\n\n9.  In the **Weight** field, specify the relative importance of this field.\n\n    The value must be an integer from 0 through 100.\n\n10. In the **Define Value Weightages** section, add field values and assign weightages.\n\n    \\[Omitted image \"custom-business-crit-risk-rule-weight.png\"\\] Alt text: Custom business criticality risk rule weightage\n\n11. Click **Submit**.\n\n\n## Add conditional criterion to the risk calculator\n\nUse custom conditions to the risk rule for risk score calculation.\n\n### Before you begin\n\nRole required: sn\\_vulc.admin\n\n### About this task\n\nAssuming that your organization has multiple configuration items \\(CIs\\), of which only a few can be accessed by an external user. Users can add risk score weightages for these outward-facing CIs.\n\n**Note:** You can identify these CIs by their name. The names start with 'external'.\n\n### Procedure\n\n1.  Navigate to **All** &gt; **Configuration Compliance** &gt; **Administration** &gt; **Risk Calculators**.\n\n2.  Navigate to the Risk rule form.\n\n3.  Clear the **Active** check box, to deactivate the rule.\n\n4.  Click **Add Criteria**.\n\n5.  From the **Choose reference table** list, select **Custom Conditions**.\n\n6.  From the **Condition table** list, select **Configuration Item**.\n\n7.  In the **Field Name** field, enter `CI Exposure`.\n\n8.  In the **Weight** field, specify the relative importance of this field.\n\n    The value must be an integer from 0 through 100.\n\n9.  In the **Condition** field, select **Name &gt; starts with**, specify the value as `external`.\n\n    \\[Omitted image \"custom-conditions-new-risk-rule.png\"\\] Alt text: Custom conditions for new risk rule\n\n10. Click **Submit**.\n\n\n**Related topics**  \n\n\n[Configuration Compliance calculator groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/configuration-compliance/vuln-config-compl-calc-groups.md)\n\n## Risk score calculation example for Configuration Compliance\n\nDetermine the risk score calculators to generate risk scores that use the test and asset data specific to your organization.\n\n### Example of determining risk rule calculators scores\n\nThe following example demonstrates how scores for risk rule calculators are determined. Assume that a risk rule calculator is configured with the fields in this table.\n\n<table id=\"table_hhf_cgp_5sb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nWeightage\n\n</th><th>\n\nWeight breakdown\n\n</th></tr></thead><tbody><tr><td>\n\nControl.Criticality\n\n</td><td>\n\n50\n\n</td><td>\n\nDefault: 0\n\n Minor: 20\n\n Low: 30\n\n Moderate: 50\n\n High: 70\n\n Critical: 100\n\n</td></tr><tr><td>\n\nBusiness\\_Criticality\n\n</td><td>\n\n50\n\n</td><td>\n\nDefault: 0\n\n Minor: 20\n\n Low: 30\n\n Moderate: 50\n\n Hight: 70\n\n Critical: 100\n\n</td></tr></tbody>\n</table>Assume that the Test Results that are shown in this table are present in the system.\n\n|ID|Business Criticality|Control Criticality|\n|---|--------------------|-------------------|\n|CTR0000001|1 – Most Critical|Minor|\n|CTR0000002|1 – Most Critical|Low|\n|CTR0000003|2 – Somewhat Critical|Minor|\n|CTR0000004|2 – Somewhat Critical|Moderate|\n|CTR0000005|3 – Less Critical|Low|\n\nThe risk score calculation for the test result is calculated based on the formula:\n\nRisk Score = \\(W\\(control.criticality\\) \\* FV \\(control.criticality\\). + W\\(business\\_criticality\\) \\* FV\\(business\\_criticality\\)\\) / 100 where W is the weight and FV is the weight percentage of the field value.\n\nThe resulting risk score for these test results is as described in this table:\n\n|ID|Business Criticality \\(50%\\)|Control Criticality \\(50%\\)|Resultant risk score|\n|---|----------------------------|---------------------------|--------------------|\n|CTR0000001|1 – Most Critical \\(50% x100\\)|Minor \\(50% x 20\\)|60|\n|CTR0000002|1 – Most Critical \\(50% x 100\\)|Low \\(50% x 30\\)|65|\n|CTR0000003|2 – Somewhat Critical \\(50% x 70\\)|Minor \\(50% x 30\\)|45|\n|CTR0000004|2 – Somewhat Critical \\(50% x 70\\)|Moderate \\(50% x 50\\)|60|\n|CTR0000005|3 – Less Critical \\(50% x 50\\)|Low \\(50% x 30\\)|40|\n\nIf the weightage percentage is changed for one of the field values, see this table for the results:\n\n<table id=\"table_hzt_jhp_5sb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nWeightage\n\n</th><th>\n\nWeight breakdown\n\n</th></tr></thead><tbody><tr><td>\n\nControl.Criticality\n\n</td><td>\n\n50\n\n</td><td>\n\nDefault: 0\n\n Minor: 20\n\n Low: 30\n\n Moderate: 60\n\n Hight: 70\n\n Critical: 100\n\n</td></tr><tr><td>\n\nBusiness\\_Criticality\n\n</td><td>\n\n50\n\n</td><td>\n\nDefault: 50\n\n 1 – Most Critical: 100\n\n 2 – Somewhat Critical: 70\n\n 3 – Less Critical: 20\n\n 4 – Not Critical: 30\n\n</td></tr></tbody>\n</table>The risk score for the test results after reapplying the calculator is shown in this table:\n\n<table id=\"table_h5p_rhp_5sb\"><thead><tr><th>\n\nID\n\n</th><th>\n\nBusiness Criticality \\(50%\\)\n\n</th><th>\n\nControl Criticality \\(50%\\)\n\n</th><th>\n\nResultant risk score\n\n</th></tr></thead><tbody><tr><td>\n\nCTR0000001\n\n</td><td>\n\n1 – Most Critical \\(50% x 100\\)\n\n</td><td>\n\nMinor \\(50% x 20\\)\n\n</td><td>\n\n60\n\n</td></tr><tr><td>\n\nCTR0000002\n\n</td><td>\n\n1 – Most Critical \\(50% x 100\\)\n\n</td><td>\n\nLow \\(50% x 30\\)\n\n</td><td>\n\n65\n\n</td></tr><tr><td>\n\nCTR0000003\n\n</td><td>\n\n2 – Somewhat Critical \\(50% x 70\\)\n\n</td><td>\n\nMinor \\(50% x 30\\)\n\n</td><td>\n\n45\n\n</td></tr><tr><td>\n\nCTR0000004\n\n</td><td>\n\n2 – Somewhat Critical \\(50% x 70\\)\n\n</td><td>\n\nModerate \\(50% x 60\\) \\*Revised value\n\n</td><td>\n\n65 \\*Revised value\n\n</td></tr><tr><td>\n\nCTR0000005\n\n</td><td>\n\n3 – Less Critical \\(50% x 20\\)\n\n \\*Revised value\n\n</td><td>\n\nLow \\(50% x 30\\)\n\n</td><td>\n\n25 \\*Revised value\n\n</td></tr></tbody>\n</table>## Risk rollup calculation example for Configuration Compliance \\(prior to v15.0\\)\n\nThe following example demonstrates how scores for risk rollup calculators are determined.\n\nFor the following remediation task rollup calculator, the formula for calculating the Remediation Task Risk Score is:\n\n\\(Maximum risk score/100\\) \\* 85 + \\(factor \\* 15\\).\n\nThe factor in the previous equation is determined by the number of test results as shown in the following table.\n\n|Test result count|Factor|\n|-----------------|------|\n|&lt;10|0.2|\n|10-99|0.4|\n|100-1000|0.6|\n|1001-9999|0.8|\n|&gt;10000|1|\n\nFor the following Remediation Task, TRG0003066, with three test results Risk scores, the maximum score is 90.\n\n|Number|Risk score|Remediation task|Result|Status|\n|------|----------|----------------|------|------|\n|CTR000123|90|TRG0003066|Failed|Open|\n|CTR000124|70|TRG0003066|Failed|Open|\n|CTR000125|40|TRG0003066|Failed|Open|\n\nFor the Remediation Task, TRG0003066:\n\nThe Risk Score is 79, \\(90/100\\) \\* 85 + 0.2 \\* 15 = Math.floor \\(76.5 +3\\) =79.\n\nThe historical risk score is null, because the Remediation Task is still 'Open'.\n\nAfter the data ingestion, the test results are 'Passed', and the Remediation Task transitions to 'Closed' as shown in the following table.\n\n|Number|Risk score\\(Prior to v15.0\\)|Remediation task|Result|Status|\n|------|----------------------------|----------------|------|------|\n|CTR000123|0|TRG0003066|Passed|Closed|\n|CTR000124|0|TRG0003066|Passed|Closed|\n|CTR000125|0|TRG0003066|Passed|Closed|\n\nTest results History is displayed in the following table.\n\n|Number|Risk score|Latest result|Result|\n|------|----------|-------------|------|\n|CTRH000111|90|CTR000123|Failed|\n|CTRH000112|70|CTR000124|Failed|\n|CTRH000113|40|CTR000125|Failed|\n\nThe Risk Score is zero, because there are no active test results in the Remediation Task.\n\nFor the Remediation Task, TRG0003066:\n\nThe Historical Risk Score is 79: \\(90/100\\) \\* 85 + 0.2 \\* 15 = Math.floor \\(76.5 +3\\) =79.\n\n## Risk rollup calculation example for Configuration Compliance \\(v15.0 and later\\)\n\nThe following example demonstrates how scores for risk rollup calculators are determined.\n\nFor the following remediation task rollup calculator, the formula for calculating the Remediation Task Risk Score is:\n\n\\(Maximum risk score\\* 80/100\\) + \\(Average risk score\\* 5/100\\) + \\(Factor \\* 15\\)\n\nWhere, the weights are as follows:\n\n-   Maximum risk score: 80\n-   Average risk score: 5\n-   Factor: 15\n\nThe default weight of the Average risk score is 0. For more information on how to set the weights, see [Edit risk rollup calculators for Configuration Compliance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/configuration-compliance/v11create-rollup-calc.md).\n\nThe factor in the previous equation is determined by the number of test results as shown in the following table.\n\n|Test result count|Factor|\n|-----------------|------|\n|&lt;10|0.2|\n|10-99|0.4|\n|100-1000|0.6|\n|1001-9999|0.8|\n|&gt;10000|1|\n\nFor the following Remediation Task, TRG0003066, with three test results Risk scores, the maximum risk score is 90 and the average risk score is 66.67.\n\n|Number|Risk score|Remediation task|Result|Status|\n|------|----------|----------------|------|------|\n|CTR000123|90|TRG0003066|Failed|Open|\n|CTR000124|70|TRG0003066|Failed|Open|\n|CTR000125|40|TRG0003066|Failed|Open|\n\nFor the Remediation Task, TRG0003066:\n\nThe Risk Score is 81, \\(90\\* 80/100\\) + \\(66.67\\* 5/100\\) + \\(0.2 \\* 15\\) = Math.floor \\(78.3 +3\\) = 81.\n\nThe historical risk score is null, because the remediation task is still 'Open'.\n\nAfter the data ingestion, the test results are 'Passed', and the Remediation Task transitions to 'Closed' as shown in the following table. Starting with v15.0 of Configuration Compliance, the Risk Score of a passed test result is populated to determine the risk mitigated.\n\n|Number|Risk score|Remediation task|Result|Status|\n|------|----------|----------------|------|------|\n|CTR000123|90|TRG0003066|Passed|Closed|\n|CTR000124|70|TRG0003066|Passed|Closed|\n|CTR000125|40|TRG0003066|Passed|Closed|\n\nTest results History is displayed in the following table.\n\n|Number|Risk score|Latest result|Result|\n|------|----------|-------------|------|\n|CTRH000111|90|CTR000123|Failed|\n|CTRH000112|70|CTR000124|Failed|\n|CTRH000113|40|CTR000125|Failed|\n\nThe Risk Score of the Remediation Task is zero, because there are no active test results in the Remediation Task.\n\nFor the Remediation Task, TRG0003066:\n\nThe Historical Risk Score is 81: \\(90\\* 80/100\\) + \\(66.67\\* 5/100\\) + \\(0.2 \\* 15\\) = Math.floor \\(78.3 +3\\) = 81.\n\n"}}