> For the complete documentation index, see [llms.txt](https://intuitem.gitbook.io/ciso-assistant/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intuitem.gitbook.io/ciso-assistant/concepts/risk/ebios-rm.md).

# EBIOS RM

**EBIOS RM** (*Expression des Besoins et Identification des Objectifs de Sécurité — Risk Manager*) is the structured risk-management method published by the French national cybersecurity agency, [ANSSI](https://cyber.gouv.fr/securisation/analyse-des-risques/methode-ebios-rm/).

CISO Assistant supports EBIOS RM natively, with a dedicated object graph rather than forcing the method into a generic risk-assessment shape.

## The five workshops

EBIOS RM organises a study around five workshops:

1. **Scope and security baseline** — define the studied system, its mission, and the regulations it must comply with.
2. **Risk origins and target objectives** — identify *who* might attack and *what* they want (the **RO/TO couples**).
3. **Strategic scenarios** — model attack paths through stakeholders to reach target objectives.
4. **Operational scenarios** — drop into technical detail: kill chains, attacker techniques, supporting assets touched.
5. **Risk treatment** — score residual risk and plan the action plan.

## Mental model

```mermaid
graph LR
  D[Domain] -->|scopes| S[EBIOS RM study]
  S -->|workshop 1| FE[Feared events]
  S -->|workshop 1| SH[Stakeholders]
  S -->|workshop 2| ROTO[RO/TO couples]
  ROTO -->|workshop 3| SS[Strategic scenarios]
  SS -->|workshop 4| OS[Operational scenarios]
  OS -->|comprises| KC[Kill chains / operating modes / elementary actions]
  SS -.->|treated by| AC[Applied controls]
  OS -.->|treated by| AC
```

An EBIOS RM **study** lives in a **domain** (no perimeter — the study itself is the scope envelope). It unfolds through five workshops that produce, in order: **feared events** (undesirable outcomes on primary assets) and **stakeholders** in workshop 1; **RO/TO couples** (Risk Origin × Target Objective) in workshop 2; **strategic scenarios** showing high-level attack paths through stakeholders in workshop 3; and **operational scenarios** drilling into kill chains, operating modes, and elementary actions in workshop 4. Workshop 5 reuses the platform's standard objects — **applied controls**, **evidence**, residual risk — to treat both strategic and operational scenarios.

| User-facing          | Internal              | Notes                                                                     |
| -------------------- | --------------------- | ------------------------------------------------------------------------- |
| EBIOS RM study       | `EbiosRMStudy`        | Container for the five workshops                                          |
| Feared event         | `FearedEvent`         | Workshop 1 outcome on a primary asset                                     |
| Stakeholder          | `Stakeholder`         | Workshop 1 — internal/external party with trust + dependency scores       |
| RO/TO couple         | `RoTo`                | Workshop 2 — Risk Origin × Target Objective                               |
| Strategic scenario   | `StrategicScenario`   | Workshop 3 — uses an attack path through stakeholders                     |
| Operational scenario | `OperationalScenario` | Workshop 4 — composed of kill chains, operating modes, elementary actions |
| Applied control      | `AppliedControl`      | Shared with the rest of the platform; used at workshop 5                  |

## Mapping to qualitative risk

EBIOS RM scenarios sit alongside qualitative risk scenarios in the same risk register: both contribute to the residual-risk picture for a perimeter, and both can be treated with the same applied controls.

## Related

* [Risk assessments](/ciso-assistant/concepts/risk/risk-assessments.md)
* [Quantitative risk studies](/ciso-assistant/concepts/risk/quantitative-risk-studies.md)
* [Guide → EBIOS RM study](/ciso-assistant/guides/assessments/ebios-rm.md)
* [Vocabulary → EBIOS RM and related terms](/ciso-assistant/introduction/vocabulary.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://intuitem.gitbook.io/ciso-assistant/concepts/risk/ebios-rm.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.