Analysis:
In Stage 4, based on data from the Expert Focus Groups, risks are plotted on a risk matrix in order to convey relative risk. Finally, in Stage 5, the National Risk Assessment is approved by the GTF on Emergency Planning, submitted to the Government and, in turn, to the EU Commission. The output from the 2023 NRA is summarised in the matrix below, where you can see the 22 key risks identified:
The reasonable worst-case scenario for the cyber risk was the exploitation of a critical vulnerability in software in widespread use across sectors. Such an event would be a malicious attack.
How did the public assess the same risks? Alongside the expert assessments completed as part of the NRA, DCU conducted some research with the public. Using an online questionnaire, we asked the public to assess the same 22 risks.