ISO 28001:2007 Supply Chain Security Management B.5: B.5 Step four: security incident scoring

The Table B.3 scoring chart determines when countermeasures should be considered: countermeasures are required for incidents scoring high in both likelihood and consequence and for medium likelihood with high consequence; high likelihood with medium consequence also requires countermeasures; consider countermeasures for high-consequence low-likelihood and medium-medium cases; document the rest; the assessor lists each incident requiring countermeasure consideration, and government officials may specify countermeasures for extremely high-consequence scenarios regardless of likelihood.