Approval of the Target Description

Abstract

This chapter presents Step 4 of the CORAS method. The main objective of this analysis step is to ensure that the background documentation for the rest of the analysis, including the target, focus and scope is correct and complete as seen by the customer. The step involves presenting a more refined description of the target to be analysed, including assumptions and preconditions being made. Typically, the analysts describe the target using a formal or semi-formal notation. Before the actual risk analysis starts at the next step of the analysis process, the description of the target should be approved by the customer. Step 4 furthermore includes defining the scales that will be used for estimating likelihoods, consequences and risk levels, as well as deciding the risk evaluation criteria for each asset. This analysis step concludes the context establishment.