A risk score is useful when it changes a decision. It should show why one threat matters more than another and how the score improves when the business adds a real control.

The DigitalHealthIns risk score method

Score one risk scenario across three factors. Keep the evidence beside the number so a low guess cannot hide a serious exposure.

Factor	Question	Scale
Likelihood	How likely is this event during the planning period?	1 rare to 5 expected
Business impact	How badly would it hurt revenue, operations, customers, or trust?	1 limited to 5 severe
Control confidence	How sure are you that the current protection works?	1 unproven to 5 tested

Risk score = likelihood × business impact × (6 minus control confidence).

Score	Decision
75 to 125	Act now. The exposure can damage the business faster than the current control can contain it.
40 to 74	Plan the next control and assign an owner.
15 to 39	Monitor the risk and verify the control on schedule.
1 to 14	Accept or watch the risk while the evidence stays current.

A ransomware risk score before and after better controls

Scenario	Likelihood	Impact	Control confidence	Risk score	Decision
Current ransomware exposure	4	5	2	80	Act now
After tested access, backup, and response controls	4	5	4	40	Plan next

The threat did not disappear. The forecast changed because the business became more likely to detect, contain, and recover from it.

Likelihood needs a time frame

Use a period the business can plan around. A score without a time frame becomes a permanent guess.

Business impact follows the real dependency

Count lost revenue, delayed work, customer harm, recovery cost, and reputation damage. A small technical failure can still earn a high impact score when the business has no fallback.

Control confidence needs a test

A policy is not the same as a working control. Give the higher score to a backup that restored, an alert that fired, or an incident drill that exposed the weak handoff before a real event did.

Act now

Assign an owner and reduce the biggest multiplier first. That may mean lowering likelihood, limiting business impact, or proving that the control works.

Plan next

Set the next control, the evidence it must produce, and the date it will be checked.

Monitor

Keep the evidence current. A monitored risk can move when the vendor, threat, dependency, or business impact changes.

Accept or watch

Record why the business accepts the exposure and what change would force another review.

Risk score and Digital Asset Health Score do different jobs

Use a risk score to rank one scenario. Use the Digital Asset Health Score to see how the full set of controls works together. Start with the digital risk assessment when you want a score now.