What an attack would cost: the costed example of Ateliers Morvan

Sum of the criticality of the business processes stopped in the worst attack scenario, divided by that of all modelled processes. A process counts as stopped as soon as a component it depends on is reached; the engine does not distinguish processes that are merely degraded. Example: shipping depends on a single workstation in Nevers; the dependency comes from the maintenance contract, the missing backup from the backup report, each with its date.

The estimated potential losses add up, for each entry point and each single point of failure, estimated annual frequency × scenario loss. The range runs from low assumptions (frequencies, days of downtime, response costs) to high ones. The worst scenario is the loss from the costliest entry point.

The “after the work” results assume these measures are carried out and produce the modelled effects: they are conditional estimates. Costs are orders of magnitude, to be confirmed by quotes. The NIS2 progress indicator (not a certification) counts the ten Article 21 measures: 1 point per measure in place, ½ if partial; it covers the measures assessed.