The RISK extension to [[[DPV]]] provides concepts for representing information associated with risk management, assessment, controls, and consequences. The namespace for terms in risk is https://www.w3id.org/dpv/risk#. The suggested prefix for the namespace is risk. The risk vocabulary and its documentation is available on GitHub.

Contributing: The DPVCG welcomes participation to improve the DPV and associated resources, including expansion or refinement of concepts, requesting information and applications, and addressing open issues. See contributing guide for further information.

Introduction

[[DPV]] provides a minimal set of risk assessment concepts that include dpv:RiskAssessment dpv:Risk, dpv:RiskMitigation, dpv:Severity, dpv:Likelihood, dpv:Consequence, and dpv:Impact along with relations or properties to use them. To further assist tasks and representation of information regarding risk assessments, as well as to support the implementation of risk management, the [[RISK]] extension provide additional concepts and taxonomies through which risks and impacts can be defined - such as to describe incidents, data breaches, their associate reports and notices, risk matrices, and other risk management processes.

The RISK extension utilises the following sources to guide and define its concepts and taxonomies:

1. ISO 31000 series, which includes:
   1. ISO 31073:2022 Risk management — Vocabulary
   2. ISO 31000:2018 Risk management — Guidelines
   3. IEC 31010:2019 Risk management – Risk assessment techniques
2. Requirements from regulations to perform risk and impact assessments, which includes:
   1. [[[GDPR]]]
   2. [[[NIS2]]]
   3. [[[AIAct]]]

Core Concepts

The core concepts involves reuse of the following concepts from [[DPV]]:

• dpv:Risk represents the concept of 'risk' i.e. a possibility or potential of negative events to occur, and is indicated using the relation dpv:hasRisk.
• dpv:RiskMitigationMeasure represents a method or process or control to mitigate the risk, and is associated using the relation dpv:isMitigatedByMeasure
• dpv:Consequence represents the consequences of risks and incidents, and is associated using the relation dpv:hasConsequence. To indicate who or what the consequence affects, the relation hasConsequenceOn is used. The [[RISK]] extension provides a taxonomy of consequences and impacts.
• dpv:Impact represents the impacts of the risks and incidents on entities, and is associated using the relation dpv:hasImpact. To indicate who the impact affects, the relation hasImpactOn is used.
• dpv:Severity represents the severity of risks and incidents, and is indicated using dpv:hasSeverity.
• dpv:Likelihood represents the likelihood of risks and incidents, and is indicated using dpv:hasLikelihood.
• dpv:RiskLevel represents the level of risks and incidents, and is indicated using dpv:hasRiskLevel. The [[RISK]] extension provides a taxonomy of risk levels.

The new concepts introduced in this extension include the following:

• [=Incident=] to represent an actual occurence of the risk i.e. to indicate a risk has materialised, which is associated with the risk with relation [=refersToRisk=]. To associate an incident with a context, such as a process or a system, the relation [=hasIncident=] is provided.
• [=IncidentStatus=] to indicate the state or status of an incident, such as whether it is ongoing or has concluded. It is associated using the relation dpv:hasStatus.
• [=RiskSource=] to represent the source or origin of risk, which is indicated using [=hasRiskSource=].
• [=Threat=] is a [=RiskSource=] which causes the risk, and is indicated by the relation [=causedByThreat=].
• [=ThreatSource=] is the agent or non-agent cause of the [=Threat=], and is indicated by the relation [=hasThreatSource=].
• [=Vulnerability=] to describe the weakness of a process, system, or entity, which is exploited by the [=ThreatSource=] in a [=Threat=] event to give rise to risk and cause an incident. [=Vulnerability=] is associated using the relation [=hasVulnerability=], and the relation [=isVulnerabilityOf=] indicates what the vulnerability is associated with.
• The relation [=exploitsVulnerability=] indicates a [=Threat=] exploits a [=Vulnerability=], and the relation [=isExploitedBy=] indicates how a [=Vulnerability=] is associated with a [=Threat=]. The relation [=causedByVulnerability=] indicates an incident is caused by a vulnerability.
• [=RiskControl=] to represent specific controls used in risk mitigation such as changing likelihoods or removing the risk source. The relation [=hasControl=] is used to associate them.
• [=RiskMatrix=] to represent the popular risk analysis method for calculating risk levels based on likelihood and severity.

Incident

To represent details about an [=Incident=] such as what personal data was involved, what technical measures were present before the incident occured, who were data subjects involved, and other pertinent details, the [[DPV]] concepts and relations should be reused.

To indicate the duration of the incident, the [[DPV]] concept dpv:Duration and relation dpv:hasRelation can be used, or dct:temporal from [[DCT]] can be used, or other means such as the [[TIME]] ontology or XSD types. If this information is unknown, then dpv:NotAvailable should be used. If the incident is ongoing, only the start would be available (also see [=IncidentStatus=]).

To indicate whether the incident is ongoing or concluded (on its own) or it was terminated due to some action taken, the concept [=IncidentStatus=] is provided along with a taxonomy of statuses which are indicated using the relation dpv:hasStatus.

Controls

[=RiskControl=] allows expressing how [[DPV]] technical and organisational measures address the risk or incident. They are associated using the relation [=hasControl=]. For example, [=ConsequenceControl=] is applied to consequences and impacts to either change them ([=ChangeConsequence=]) such as by reducing their likelihood or severity, or removing them ([=RemoveConsequence=]) completely. [=MonitorControl=] represents controls used to monitor events or effectiveness, such as to detect impacts ([=MonitorImpact=]) or identify vulnerabilities ([=MonitorVulnerabilities=]).

Taxonomies

The RISK extension provides a single unified taxonomy of concepts that can take on the roles of `RiskSource`, `Risk`, `Consequence`, and `Impact` in an use-case. For example, the same concept `DataBreach` can be the the `Risk` in a risk assessment whose impacts are to be determined, or it can be the `Impact` whose causes must be discovered. By providing a single taxonomy, the adopter is free to choose which role the concept plays within their use-case - which offers significant benefits in terms of both extensibility and flexibility, allowing users to tailor the taxonomy to their specific use cases while maintaining a consistent framework.

The RISK taxonomy's design allows it to be highly and easily extensible as concepts are not required to be strictly categorised as risks or impacts within the DPV specifications itself. This is particularly valuable as the areas of cybersecurity and AI technologies are rapidly evolving landscapes where new risks and risk sources frequently emerge.

To enable the creation of this taxonomy, the concept `dpv:RiskConcept` acts as the parent or top concept, and `dpv:Risk`, `dpv:Consequence`, `dpv:Impact`, and `risk:RiskSource` are defined as its subclasses. To utilise these concepts in particular roles, the associated relations or properties such as `dpv:hasRisk` and `dpv:hasImpact` are used.

Rights Impacts

lorem ipsum

Risk Matrix

Risk Matrix is a popularly used technique for qualitative risk analysis, through which a risk's likelihood and severity are used to obtain an overall risk level. To support its use, the RISK taxonomy provides concepts representing risk matrices of the format 3x3, 5x5, and 7x7. The concepts are expressed as combinations of Severity (Sx) and Likelihood (Lx) levels, and the resulting Risk Level (Lx) being used as its label. For example, the concept [=RM3x3S1L3=] represents a node in a 3x3 matrix with Severity and Likelihood level low (n=1) and Likelihood level high (n=3) with a resulting Risk Level of 'Moderate'. Similarly, [=RM7x7S4L7=] represents a node in a 7x7 risk matrix with Severity level moderate (n=4) and Likelihood level extremely high (n=7) with the resulting Risk Level of 'Very High Risk'.

It is possible to change the risk levels for the risk matrix by replacing the supplied labels with a custom one. For example, to indicate that the concept [=RM3x3S1L3=] should be 'Low Risk' instead of 'Moderate'.

Vocabulary Index