CCS Risk Manager Action Plan "Projected Risk Scores" differ from the Current Risk score value

Products

• Control Compliance Suite Windows

Issue/Introduction

Risk Manager action plan risk scores seem to vary between the value for the "Current Risk score" and the "Projected Risk Score" even when all data is coming from one source and there is a 100% weighting factor.

 

Cause

 

 

Environment

Control Compliance Suite 11.x and 12.x

 

Resolution

The "Projected Risk Score" pertains to the assets that are part of the Action Plan only.  While the "Current Risk Score" pertains to the entire Security Objective (SO) and all assets associated to it.

When the Action Plan does not contain all of the same assets that the SO contains, the scores will deviate.