# Risk verdict

<!-- ASSURED Methodology by Timothy Zilber, © Block, Inc., CC BY 4.0
     (https://creativecommons.org/licenses/by/4.0/). Reuse and adapt freely
     with attribution; note any changes you make.
     Template version: 2.0
     ASSURED Risk: producing the assessment
     (https://assured-methodology.vercel.app/docs/risk/impact-likelihood#verdict-block).
     Paste this into the case record at the end of Risk. When the case
     escalates, the same fields travel in section 5 of the handoff packet;
     when it closes, they sit under the Escalation decision in the case's
     report. Risk recommends; the Escalation decision makes and records the
     call. -->

- Case ID:
- Assessed by (analyst), at (UTC):

## Risk verdict

<!-- Impact is the higher of asset criticality and business impact.
     Likelihood is how probable it is that the activity is malicious or
     unauthorized; confidence is your analytic confidence in that judgment.
     Unexamined evidence means low confidence, not low likelihood. -->

- Verdict, detection axis (true positive / false positive (logic) /
  false positive (data)):
- Verdict, activity axis (malicious / policy violation / authorized (benign
  true positive) / benign-confirmed / undetermined):
- Impact (H/M/L), the higher of asset criticality and business impact:
  - Asset criticality (H/M/L), with rationale:
  - Business impact (H/M/L), with rationale:
- Likelihood that the activity is malicious or unauthorized (H/M/L), with
  rationale:
- Confidence in that judgment (high / medium / low, on the shared rubric),
  and any dimension that is Unknown:
- Matrix cell (impact / likelihood) and priority (P1-P4):
- Override applied (none / escalation tripwire / high-impact clock /
  documented downgrade), with reason:
- Recommended move (escalate now / escalate within 4 hours / keep working
  to the re-score trigger / documented close):
- Re-score trigger and time (P3 or undetermined):
- Open questions, and what evidence would change the assessment: