Edit EN-304-624.md First update of Figure C.2.2-1 (Risk evaluation part 1)

## B.4 Evaluate Risks

This clause presents the evaluation of the risk factors for each of the use cases. The following tables evaluate the risks for each use case related to threats defined in clause 4. For each threat the list of associated risk factors values are assessed and for each combination of factors a maximum function is applied (the resulting impact or likelihood level is the maximum of all risk factors levels).

The risk are then calculated and their applicability defined using the matrixes presented below.

<div align="center">

**Table B.13: Risk evaluation part 1**

</br>

<table style="border-collapse:collapse; width:100%;">

  <tr>

    <td colspan="3">Threat</td>

    <td colspan="6">Risk-factor</td>

    <td colspan="1">Value UC1</td>

    <td colspan="1">Value UC2</td>

    <td colspan="1">Value UC3</td>

    <td colspan="1">Value UC4</td>

    <td colspan="6">Value UC4</td>

  </tr>

  <tr>

    <th>ID</th>

    <th>Description</th>

    <th>Asset</th>

    <th>Impact Type</th>

    <th>Value UC1</th>

    <th>Value UC2</th>

    <th>Value UC3</th>

    <th>Value UC4</th>

    <th>Likelihood Type</th>

    <th>Value UC1</th>

    <th>Value UC2</th>

    <th>Value UC3</th>

    <th>Value UC4</th>

    <th>Risk Value UC1</th>

    <th>Risk Value UC2</th>

    <th>Risk Value UC3</th>

    <th>Risk Value UC4</th>

    <th>UC / App.</th>

  </tr>

  <tr>

    <td>T_SYS01</td>

    <td>Exploiting insecure settings in default system configuration data </td>

    <td>SYS01</td>

    <td>Availability</td>

    <td>AVA-2</td>

    <td>AVA-1</td>

    <td>AVA-1</td>

    <td>NA</td>

    <td></td>

    <td>DEP-2 <br> NET-1 <br> USR-1 <br> OPS-1 <br> IF-1</td>

    <td>DEP-0 <br> NET-2 <br> USR-1 <br> OPS-2 <br> IF-1</td>

    <td>DEP-0 <br> NET-2 <br> USR-2 <br> OPS-2 <br> IF-2</td>

    <td>NA</td>

    <td>Low</td>

    <td>High</td>

    <td>High</td>

    <td>NA</td>

    <td>UC2, UC3</td>

  </tr>

</table>

</div>

# Annex C (Informative) Relationship between the present document and any related ETSI standards (if any, e.g. EN 303 645)