Risk matrix

A four-by-four risk matrix of likelihood against impact with Low, Medium, High and Critical cells, two worked risk examples (remote-access compromise of the plant network and USB malware on an engineering station) moving from current to residual position after added controls, and example controls that lower likelihood or consequence.