Game play
How risk is scored
Where Low / Medium / High come from and how to challenge a rating.
Every decision and outcome in DECID:R is scored against a likelihood × impact matrix derived from NIST SP 800-30 and ISO 27005. The full methodology is on the /risk-model page; this guide is the short version.
Likelihood
Five bands from Rare to Almost Certain, anchored to a frequency (e.g. "less than once in 10 years" through "multiple times per year"). Scenarios use the bands consistently across industries.
Impact
Scored across four dimensions: public trust, operational capacity, threat containment and financial cost. The headline rating is the worst of the four, not the average, so a single catastrophic dimension dominates.
Challenging a rating
If a rating in your debrief feels wrong for your context, use "Challenge this rating" on the outcome card. The challenge is logged against the scenario; if multiple customers flag the same item we re-score it in the next library refresh.
Was this helpful? If something's missing or unclear, tell us and we'll improve it.