The RISK extension to [[[DPV]]] provides concepts for representing information associated with risk management, assessment, controls, and consequences. The namespace for terms in risk is https://www.w3id.org/dpv/risk#. The suggested prefix for the namespace is risk. The risk vocabulary and its documentation is available on GitHub.
Contributing: The DPVCG welcomes participation to improve the DPV and associated resources, including expansion or refinement of concepts, requesting information and applications, and addressing open issues. See contributing guide for further information.
DPV and Related Resources
[[[DPV]]]: is the base/core specification for the 'Data Privacy Vocabulary', which is extended for Personal Data [[PD]], Locations [[LOC]], Risk Management [[RISK]], Technology [[TECH]], and [[AI]]. Specific [[LEGAL]] extensions are also provided which model jurisdiction specific regulations and concepts . To support understanding and applications of [[DPV]], various guides and resources [[GUIDES]] are provided, including a [[PRIMER]]. A Search Index of all concepts from DPV and extensions is available.
[[DPV]] and related resources are published on GitHub. For a general overview of the Data Protection Vocabularies and Controls Community Group [[DPVCG]], its history, deliverables, and activities - refer to DPVCG Website. For meetings, see the DPVCG calendar.
The peer-reviewed article “Creating A Vocabulary for Data Privacy” presents a historical overview of the DPVCG, and describes the methodology and structure of the DPV along with describing its creation. An open-access version can be accessed here, here, and here. The article Data Privacy Vocabulary (DPV) - Version 2, accepted for presentation at the 23rd International Semantic Web Conference (ISWC 2024), describes the changes made in DPV v2.
Introduction
[[DPV]] provides a minimal set of risk assessment concepts that include dpv:RiskAssessmentdpv:Risk, dpv:RiskMitigation, dpv:Severity, dpv:Likelihood, dpv:Consequence, and dpv:Impact along with relations or properties to use them. To further assist tasks and representation of information regarding risk assessments, as well as to support the implementation of risk management, the [[RISK]] extension provide additional concepts and taxonomies through which risks and impacts can be defined - such as to describe incidents, data breaches, their associate reports and notices, risk matrices, and other risk management processes.
The RISK extension utilises the following sources to guide and define its concepts and taxonomies:
Requirements from regulations to perform risk and impact assessments, which includes:
[[[GDPR]]]
[[[NIS2]]]
[[[AIAct]]]
Core Concepts
Overview of Risk Assessment and Management concepts in DPV and RISK extension
The core concepts involves reuse of the following concepts from [[DPV]]:
dpv:Risk represents the concept of 'risk' i.e. a possibility or potential of negative events to occur, and is indicated using the relation dpv:hasRisk.
dpv:Impact represents the impacts of the risks and incidents on entities, and is associated using the relation dpv:hasImpact. To indicate who the impact affects, the relation hasImpactOn is used.
The new concepts introduced in this extension include the following:
[=Incident=] to represent an actual occurence of the risk i.e. to indicate a risk has materialised, which is associated with the risk with relation [=refersToRisk=]. To associate an incident with a context, such as a process or a system, the relation [=hasIncident=] is provided.
[=IncidentStatus=] to indicate the state or status of an incident, such as whether it is ongoing or has concluded. It is associated using the relation dpv:hasStatus.
[=RiskSource=] to represent the source or origin of risk, which is indicated using [=hasRiskSource=].
[=Threat=] is a [=RiskSource=] which causes the risk, and is indicated by the relation [=causedByThreat=].
[=ThreatSource=] is the agent or non-agent cause of the [=Threat=], and is indicated by the relation [=hasThreatSource=].
[=Vulnerability=] to describe the weakness of a process, system, or entity, which is exploited by the [=ThreatSource=] in a [=Threat=] event to give rise to risk and cause an incident. [=Vulnerability=] is associated using the relation [=hasVulnerability=], and the relation [=isVulnerabilityOf=] indicates what the vulnerability is associated with.
The relation [=exploitsVulnerability=] indicates a [=Threat=] exploits a [=Vulnerability=], and the relation [=isExploitedBy=] indicates how a [=Vulnerability=] is associated with a [=Threat=]. The relation [=causedByVulnerability=] indicates an incident is caused by a vulnerability.
[=RiskControl=] to represent specific controls used in risk mitigation such as changing likelihoods or removing the risk source. The relation [=hasControl=] is used to associate them.
[=RiskMatrix=] to represent the popular risk analysis method for calculating risk levels based on likelihood and severity.
risk:RiskManagement: Systematic application of management policies, procedures, and practices for communicating, consulting, establishing context, and identifying, analysing, evaluating, treating, monitoring and reviewing risk. ISO 31000 definition: coordinated activities to direct and control an organization with regard to risk
go to full definition
risk:RiskAssessment: Assessment of risk involving its identification, analysis, and evaluation
go to full definition
risk:RiskAnalysis: A technique or method used to analyse and identify risk levels, sources, likelihoods, severities, and other necessary information required to conduct risk management procedures
go to full definition
risk:RiskMatrix: Compares individual risks by selecting a consequence/ likelihood pair and displaying them on a matrix with consequence on one axis and likelihood on the other.
go to full definition
risk:RiskSource: The 'cause' or 'source', which by itself or with another source has the potential to give rise to risk
go to full definition
risk:ThreatSource: Source of threat event, including both agent and non-agent sources
go to full definition
risk:Vulnerability: Intrinsic property of a system or asset that is utilised by the Threat Source in a Threat event to cause Risk
go to full definition
Likelihood, Severity, and Levels
To express likelihoods, severities, and levels in a convenient manner, the RISK extension provides the following groups of concepts. Each concept is associated with a suggested value to represent the extent or degree of the concept between 0..1 using rdf:value e.g. [=ExtremelyLowRisk=] has a value of 0.01 and [=HighLikelihood=] has a value of 0.75. Each group uses these values to express a range within a group e.g. in [=3LikelihoodLevels=] the [=LowLikelihood=] (0.25) covers the range 0 to 0.25, while in [=7LikelihoodLevels=] it covers the range from 0.1 ([=VeryLowLikelihood=]) to 0.25. Adopters can thus choose the appropriate ranges, and as the values are suggestions - they can be changed to match the requirements of the use-case.
Likelihood:
[=3LikelihoodLevels=] which contains 3 likelihood levels of [=HighLikelihood=] (0.75), [=ModerateLikelihood=] (0.5), and [=LowLikelihood=] (0.25)
[=5LikelihoodLevels=] which contains the 3 likelihood levels from [=3LikelihoodLevels=] as well as [=VeryHighLikelihood=] (0.9) and [=VeryLowLikelihood=] (0.1)
[=7LikelihoodLevels=] which contains the 5 likelihood levels from [=5LikelihoodLevels=] as well as [=ExtremelyHighLikelihood=] (0.99) and [=ExtremelyLowLikelihood=] (0.01)
Severity:
[=3SeverityLevels=] which contains 3 Severity levels of [=HighSeverity=] (0.75), [=ModerateSeverity=] (0.5), and [=LowSeverity=] (0.25)
[=5SeverityLevels=] which contains the 3 Severity levels from [=3SeverityLevels=] as well as [=VeryHighSeverity=] (0.9) and [=VeryLowSeverity=] (0.1)
[=7SeverityLevels=] which contains the 5 Severity levels from [=5SeverityLevels=] as well as [=ExtremelyHighSeverity=] (0.99) and [=ExtremelyLowSeverity=] (0.01)
RiskLevel:
[=3RiskLevels=] which contains 3 RiskLevel levels of [=HighRisk=] (0.75), [=ModerateRisk=] (0.5), and [=LowRisk=] (0.25)
[=5RiskLevels=] which contains the 3 RiskLevel levels from [=3RiskLevels=] as well as [=VeryHighRisk=] (0.9) and [=VeryLowRisk=] (0.1)
[=7RiskLevels=] which contains the 5 RiskLevel levels from [=5RiskLevels=] as well as [=ExtremelyHighRisk=] (0.99) and [=ExtremelyLowRisk=] (0.01)
risk:3LikelihoodLevels: Scale with 3 Likelihood Levels from High to Low
go to full definition
To represent details about an [=Incident=] such as what personal data was involved, what technical measures were present before the incident occured, who were data subjects involved, and other pertinent details, the [[DPV]] concepts and relations should be reused.
To indicate the duration of the incident, the [[DPV]] concept dpv:Duration and relation dpv:hasRelation can be used, or dct:temporal from [[DCT]] can be used, or other means such as the [[TIME]] ontology or XSD types. If this information is unknown, then dpv:NotAvailable should be used. If the incident is ongoing, only the start would be available (also see [=IncidentStatus=]).
To indicate whether the incident is ongoing or concluded (on its own) or it was terminated due to some action taken, the concept [=IncidentStatus=] is provided along with a taxonomy of statuses which are indicated using the relation dpv:hasStatus.
risk:AccidentalIncident: Incident caused due to accidental actions arising from human or human-controlled situations
go to full definition
risk:AvailabilityIncident: Incident where the availability of information or system has been affected
go to full definition
risk:ConfidentialityIncident: Incident where the confidentiality of information or system has been affected
go to full definition
risk:CrossBorderIncident: Incident involving cross-border or multiple jurisdictions
go to full definition
risk:DeliberateIncident: Incident caused due to deliberate actions of a human
go to full definition
risk:EnvironmentalIncident: Incident caused due to environmental factors outside human controls
go to full definition
risk:IntegrityIncident: Incident where the integrity of information or system has been affected
go to full definition
risk:IncidentIdentifier: Identifier associated with an incident
go to full definition
risk:IncidentImpactAssessment: An impact assessment associated with a incident
go to full definition
risk:IncidentMitigationMeasure: A mitigation measure taken in response specifically to mitigate an incident and prevent it from occurring again
go to full definition
risk:IncidentRegister: A register recording incidentes, their reports, notifications, and other related activities
go to full definition
risk:IncidentReport: Documented information about an incident, its handling, assessments,and notifications
go to full definition
risk:IncidentAssessmentReport: A report describing the assessment of an incident in terms of its effects or impacts
go to full definition
risk:IncidentConcludingReport: A report describing the conclusion of an investigation regarding a Incident where all relevant facts are known
go to full definition
risk:IncidentDetectionReport: A report describing the detection of a Incident
go to full definition
risk:IncidentHandlingReport: A report describing the response to or handling of an incident regarding the mitigation of its effects and the prevention of its recurrence
go to full definition
risk:IncidentOngoingReport: A report describing on ongoing investigation regarding a Incident where facts and extent of the investigation are being investigated
go to full definition
risk:IncidentPreliminaryReport: A report describing the preliminary investigation regarding a Incident where the complete facts or extent of the incident may not be known
go to full definition
risk:IncidentSuspectedReport: A report describing the suspicion of an incident in the past or occuring
go to full definition
risk:IncidentConcluded: The incident has stopped or finished or concluded without any active mitigation and with a low likelihood of resuming or recurring
go to full definition
risk:IncidentHalted: The incident has halted or paused with a high likelihood of resuming or recurring
go to full definition
risk:IncidentMitigated: The incident has been mitigated against future recurrences i.e. a measure has been applied to prevent the same or similar incident from recurring
go to full definition
risk:IncidentNearMiss: The state where an incident was almost successful in taking place i.e. "it came very close"
go to full definition
risk:IncidentOngoing: The incident is ongoing i.e. still active
go to full definition
risk:IncidentStatusUnknown: The status of a incident is unknown
go to full definition
risk:IncidentSuspected: The state where a incident is suspected, but has not yet been confirmed. This can be due to lack of information, or because the process of detection and investigation is still ongoing
go to full definition
risk:IncidentTerminated: The incident has been stopped or terminated through the use of a mitigation or deterrent measure with a low likelihood of resuming or recurring
go to full definition
Incident Report
Controls
[=RiskControl=] allows expressing how [[DPV]] technical and organisational measures address the risk or incident. They are associated using the relation [=hasControl=]. For example, [=ConsequenceControl=] is applied to consequences and impacts to either change them ([=ChangeConsequence=]) such as by reducing their likelihood or severity, or removing them ([=RemoveConsequence=]) completely. [=MonitorControl=] represents controls used to monitor events or effectiveness, such as to detect impacts ([=MonitorImpact=]) or identify vulnerabilities ([=MonitorVulnerabilities=]).
The RISK extension provides a single unified taxonomy of concepts that can take on the roles of `RiskSource`, `Risk`, `Consequence`, and `Impact` in an use-case. For example, the same concept `DataBreach` can be the the `Risk` in a risk assessment whose impacts are to be determined, or it can be the `Impact` whose causes must be discovered. By providing a single taxonomy, the adopter is free to choose which role the concept plays within their use-case - which offers significant benefits in terms of both extensibility and flexibility, allowing users to tailor the taxonomy to their specific use cases while maintaining a consistent framework.
The RISK taxonomy's design allows it to be highly and easily extensible as concepts are not required to be strictly categorised as risks or impacts within the DPV specifications itself. This is particularly valuable as the areas of cybersecurity and AI technologies are rapidly evolving landscapes where new risks and risk sources frequently emerge.
To enable the creation of this taxonomy, the concept `dpv:RiskConcept` acts as the parent or top concept, and `dpv:Risk`, `dpv:Consequence`, `dpv:Impact`, and `risk:RiskSource` are defined as its subclasses. To utilise these concepts in particular roles, the associated relations or properties such as `dpv:hasRisk` and `dpv:hasImpact` are used.
The concepts taxonomy is broadly divided into the following categories:
risk:BruteForceAuthorisations: Something that acts as or causes Brute Force Authorisations i.e. bypassing authorisations through brute forcing techniques
go to full definition
risk:SystemIntrusion: Something that acts as or causes System Intrusion
go to full definition
risk:UnauthorisedAccesstoPremises: Something that acts as or causes Unauthorised Access to Premises
go to full definition
risk:UnauthorisedActivity: Something that acts as or causes Unauthorised Activity
go to full definition
risk:UnauthorisedCodeAccess: Something that acts as or causes Unauthorised Code Access
go to full definition
risk:UnauthorisedCodeDisclosure: Something that acts as or causes Unauthorised Code Disclosure
go to full definition
risk:UnauthorisedDataAccess: Something that acts as or causes Unauthorised Data Access
go to full definition
risk:UnauthorisedDataDisclosure: Something that acts as or causes Unauthorised Data Disclosure
go to full definition
risk:UnauthorisedInformationDisclosure: Something that acts as or causes Unauthorised Information Disclosure
go to full definition
risk:UnauthorisedReidentification: Something that acts as or causes Unauthorised Re-Identification
go to full definition
risk:UnauthorisedSystemAccess: Something that acts as or causes Unauthorised System Access
go to full definition
risk:UnwantedDisclosureData: Something that acts as or causes Unwanted Disclosure of Data
go to full definition
Integrity
risk:AuthorisationFailure: Something that acts as or causes Authorisation Failure
go to full definition
risk:BruteForceAuthorisations: Something that acts as or causes Brute Force Authorisations i.e. bypassing authorisations through brute forcing techniques
go to full definition
risk:CompromiseAccount: Something that acts as or causes a compromised account that is then used by the compromiser
go to full definition
risk:Compensation: Something that acts as or provides compensation - which can be monetary and financial or in other forms
go to full definition
risk:Fee: Something that acts as or provides fees e.g. for using a service
go to full definition
risk:FinancialLoss: Something that acts as or causes Financial Loss which may be actual loss of existing financial assets or hypothetical loss of financial opportunity
go to full definition
risk:JudicialCosts: Something that involves or causes judicial costs to be paid
go to full definition
risk:JudicialPenalty: Something that involves or causes judicial penalties to be paid
go to full definition
risk:Payment: Something that acts as or provides payment e.g. to access a service or purchase resources
go to full definition
risk:Renumeration: Something that acts as or provides renumeration which is in monetary or financial form
go to full definition
risk:Reward: Something that acts as or provides rewards i.e. a benefit given for some service or activity that is not a payment or fee
go to full definition
Bias
Note: These are intended to represent bias concepts in general e.g. applicable for any technology. The AI extension contains an additional set of concepts that extend these concepts to represent biases that are specific to the development and use of AI.
risk:CognitiveBias: Bias that occurs when humans are processing and interpreting information
go to full definition
risk:ConfirmationBias: Bias that occurs when hypotheses, regardless of their veracity, are more likely to be confirmed by the intentional or unintentional interpretation of information
go to full definition
risk:GroupAttributionBias: Bias that occurs when a human assumes that what is true for an individual or object is also true for everyone, or all objects, in that group
go to full definition
risk:ImplicitBias: Bias that occurs when a human makes an association or assumption based on their mental models and memories
go to full definition
risk:InGroupBias: Bias that occurs when showing partiality to one's own group or own characteristics
go to full definition
risk:OutGroupHomogeneityBias: Bias that occurs when seeing out-group members as more alike than in-group members when comparing attitudes, values, personality traits, and other characteristics
go to full definition
risk:RequirementsBias: Bias that occurs in or during requirements creation
go to full definition
risk:RuleBasedSystemDesign: Bias that occurs due to developer experience and expert advice having a significant influence on rule-based system design
go to full definition
risk:SocietalBias: Bias that occurs when similiar cognitive bias (conscious or unconscious) is being held by many individuals in society
go to full definition
risk:DataBias: Bias that occurs when data properties that if unaddressed lead to systems that perform better or worse for different groups
go to full definition
risk:DataAggregationBias: Bias that occurs when aggregating data covering different groups of objects has different statistical distributions that introduce bias into the data
go to full definition
risk:DataProcessingBias: Bias that occurs due to pre-processing (or post-processing) of data, even though the original data would not have led to any bias
go to full definition
risk:SimpsonsParadoxBias: Bias that occurs when a trend that is indicated in individual groups of data reverses when the groups of data are combined
go to full definition
risk:StatisticalBias: Bias that occurs as the type of consistent numerical offset in an estimate relative to the true underlying value, inherent to most estimates
go to full definition
risk:ConfoundingVariablesBias: Bias that occurs as a confounding variable that influences both the dependent variable and independent variable causing a spurious association
go to full definition
risk:NonNormalityBias: Bias that occurs when the dataset is subject to a different (i.e. non-normal) distribution (e.g., Chi-Square, Beta, Lorentz, Cauchy, Weibull or Pareto) where the results can be biased and misleading
go to full definition
risk:SelectionBias: Bias that occurs when a dataset's samples are chosen in a way that is not reflective of their real-world distribution
go to full definition
risk:CoverageBias: Bias that occurs when a population represented in a dataset does not match the actual or real population that are being used
go to full definition
risk:NonResponseBias: Bias that occurs when people from certain groups opt-out of surveys at different rates than users from other groups. This is also called as Participation bias
go to full definition
risk:SamplingBias: Bias that occurs when data records are not collected randomly from the intended population
go to full definition
Risk Matrix
Risk Matrix is a popularly used technique for qualitative risk analysis, through which a risk's likelihood and severity are used to obtain an overall risk level. To support its use, the RISK taxonomy provides concepts representing risk matrices of the format 3x3, 5x5, and 7x7. The concepts are expressed as combinations of Severity (Sx) and Likelihood (Lx) levels, and the resulting Risk Level (Lx) being used as its label. For example, the concept [=RM3x3S1L3=] represents a node in a 3x3 matrix with Severity and Likelihood level low (n=1) and Likelihood level high (n=3) with a resulting Risk Level of 'Moderate'. Similarly, [=RM7x7S4L7=] represents a node in a 7x7 risk matrix with Severity level moderate (n=4) and Likelihood level extremely high (n=7) with the resulting Risk Level of 'Very High Risk'.
It is possible to change the risk levels for the risk matrix by replacing the supplied labels with a custom one. For example, to indicate that the concept [=RM3x3S1L3=] should be 'Low Risk' instead of 'Moderate'.
Something that acts as or causes Component Failure
Usage Note
Here component refers to both physical and virtual components. The failure of a component may or may not also cause a failure in other related components or the systems they are part of
Something that acts as or causes Component Malfunction
Usage Note
Here component refers to both physical and virtual components. The malfunction of a component may or may not also cause a malfunction in other related components or the systems they are part of
Bias that occurs when hypotheses, regardless of their veracity, are more likely to be confirmed by the intentional or unintentional interpretation of information
The state where a incident is suspected, but has not yet been confirmed. This can be due to lack of information, or because the process of detection and investigation is still ongoing
Risk Mitigation Measure that uses controls to monitor events
Usage Note
Monitoring can be associated with characteristics such as assessing or detecting whether something is active, operational, performant, effective, has potential to materialise, is materialising, or has already materialised.
Bias that occurs when the dataset is subject to a different (i.e. non-normal) distribution (e.g., Chi-Square, Beta, Lorentz, Cauchy, Weibull or Pareto) where the results can be biased and misleading
Bias that occurs when people from certain groups opt-out of surveys at different rates than users from other groups. This is also called as Participation bias
Bias that occurs when seeing out-group members as more alike than in-group members when comparing attitudes, values, personality traits, and other characteristics
Something that acts as or causes Re-identification
Usage Note
Use this concept for reidentification in an internal context. For reidentification performed by external entities see concept UnauthorisedReidentification
A technique or method used to analyse and identify risk levels, sources, likelihoods, severities, and other necessary information required to conduct risk management procedures
Systematic application of management policies, procedures, and practices for communicating, consulting, establishing context, and identifying, analysing, evaluating, treating, monitoring and reviewing risk. ISO 31000 definition: coordinated activities to direct and control an organization with regard to risk
Compares individual risks by selecting a consequence/ likelihood pair and displaying them on a matrix with consequence on one axis and likelihood on the other.
DPV uses the following terms from [[RDF]] and [[RDFS]] with their defined meanings:
rdf:type to denote a concept is an instance of another concept
rdfs:Class to denote a concept is a Class or a category
rdfs:subClassOf to specify the concept is a subclass (subtype, sub-category, subset) of another concept
rdf:Property to denote a concept is a property or a relation
The following external concepts are re-used within DPV:
External
Contributors
The following people have contributed to this vocabulary. The names are ordered alphabetically. The affiliations are informative do not represent formal endorsements. Affiliations may be outdated. The list is generated automatically from the contributors listed for defined concepts.
Axel Polleres (Vienna University of Economics and Business)
Beatriz Esteves (IDLab, IMEC, Ghent University)
Daniel Doherty ()
Delaram Golpayegani (ADAPT Centre, Trinity College Dublin)
Fajar Ekaputra (Vienna University of Technology)
Georg P. Krog (Signatu AS)
Harshvardhan J. Pandit (ADAPT Centre, Dublin City University)
Julian Flake (University of Koblenz)
Julio Fernandez (Trinity College Dublin)
Rob Brennan (University College Dublin)
Funding Acknowledgements
Funding Sponsors
The DPVCG was established as part of the SPECIAL H2020 Project, which received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 731601 from 2017 to 2019.
Harshvardhan J. Pandit was funded to work on DPV from 2020 to 2022 by the Irish Research Council's Government of Ireland Postdoctoral Fellowship Grant#GOIPD/2020/790.
The ADAPT SFI Centre for Digital Media Technology is funded by Science Foundation Ireland through the SFI Research Centres Programme and is co-funded under the European Regional Development Fund (ERDF) through Grant#13/RC/2106 (2018 to 2020) and Grant#13/RC/2106_P2 (2021 onwards).
Funding Acknowledgements for Contributors
The contributions of Beatriz Esteves and Delaram Golpayegani have received funding through the PROTECT ITN Project from the European Union’s Horizon 2020 research and innovation programme under the Marie Skłodowska-Curie grant agreement No 813497.
The contributions of Harshvardhan J. Pandit, Delaram Golpayegani, and Rob Brennan have been made with the financial support of Science Foundation Ireland under Grant Agreement No. 13/RC/2106_P2 at the ADAPT SFI Research Centre.
