Risk Analysis with Magerit: Methodology Applied to a Real Case

1. Introduction

Risk analysis with Magerit is the reference methodology in Spain for assessing and treating risks to information systems. Developed by the former Ministry of Public Administrations and maintained by CCN-CERT, Magerit allows any organization, public or private, to identify its assets, understand the threats against them and calculate impact in an objective, reproducible way. In this article we apply the methodology to the real case of an SME with cloud services.

Risk analysis with Magerit is not just a practical obligation to comply with the ENS (National Security Scheme) or regulations such as GDPR: it is a management tool that lets you prioritize security investments with data instead of feelings. Many companies discover after their first analysis that their most critical assets are not the most expensive ones, and that threats which seemed remote have much higher probability and impact than imagined.

The Magerit methodology rests on three core concepts: assets, threats and safeguards. From them, the degradation of each asset against each threat is calculated and, with that information, the accumulated risk of every asset. The result is a clear report that feeds the treatment plan: accept, reduce, transfer or avoid each identified risk.

Throughout this article we carry out a complete risk analysis with Magerit on the case of a 40-employee SME: asset inventory, threat rating with standard degradations, application of existing safeguards and the final residual risk using the official tables. Exactly as Jaymon Security does in our clients’ risk analysis projects.

2. The Magerit methodology in a nutshell

Magerit runs in iterative phases. Version 4.0 (currently in force) also introduces integration with ISO 27005 and the ENS, defining the following steps:

Phase	Activity	Main output
1	Asset inventory and valuation	Asset list with value (C, I, A)
2	Threat identification	Asset-threat matrix with typical degradation
3	Safeguard assessment	Effectiveness of existing controls
4	Risk calculation	Intrinsic and residual risk per asset
5	Risk treatment	Improvement plan and risk acceptance

Fig. 1 – Phases of risk analysis with Magerit and their main outputs.

The CCN’s PILAR tool automates the process and generates ENS-compliant documentation. Still, understanding the manual calculation is essential so you do not treat the tool like a black box.

2.1. PILAR, CCN’s assistant, step by step

PILAR structures risk analysis with Magerit into successive screens that any auditor must master. The assets screen shows the dependency tree: each asset’s valuation is inherited by the lower ones, so a server failure degrades the ERP that depends on it. The threats screen unfolds, for each asset, the full catalogue with the typical degradations preloaded, and the valuation screen paints the thermal state of each asset, from green to red, with the acceptable risk marked by the thresholds of the organization’s security policy. The milestone report compares iterations and shows progress after each safeguard, valuable when reporting to management. A separate safeguards screen estimates the effectiveness and cost of each countermeasure, and the report generator assembles the ENS documents in a few clicks.

3. Asset inventory of the example SME

Our case: “TecnoPYME Ltd.”, 40 employees, 3 offices, its own ERP on an on-premise server, cloud CRM, public website and a customer database with personal data. Current safeguards: antivirus, perimeter firewall, weekly backups and strong passwords on the ERP.

We classify assets into Magerit groups [l:location, p:personnel, t:services, s:applications, d:data, sw:software, h:hardware, c:communications]:

[d:data]       Customer_DB (high: C-I-A)
[d:data]       ERP_Data (high: C-I; M: A)
[s:applications] ERP (exposes Customer_DB)
[s:applications] Cloud_CRM (commercial data)
[h:hardware]    ERP_Server (essential for the ERP)
[c:comms]       Office1_Router, Corp_VPN
[p:personnel]   Staff_40 (key people in security)

Fig. 2 – Extract of the asset inventory with valuation dimensions.

Valuation example: Customer_DB is rated “high” because it contains personal data and regulatory non-compliance carries GDPR fines. Magerit defines scales from 0 to 10; in our case we use the qualitative scale of the official guide.

3.1. Valuation dimensions: C, I, A and T

Magerit v4 values each asset on five dimensions: confidentiality (C), integrity (I), availability (A), authenticity (Aut) and traceability (T), on a scale from 0 (irrelevant) to 10 (extremely critical). Each dimension reflects the damage its loss would cause; traceability matters especially for personal data, since a breach without an audit trail cannot even be proven.

Asset	C	I	A	Aut	T
Customer_DB	9	9	8	8	7
ERP_Data	8	9	7	8	6
ERP_Server	5	6	10	5	4
Office1_Router	4	5	9	3	3
Corp_VPN	7	6	8	7	5

Note that availability dominates in network and server assets, while personal data raises confidentiality and traceability: that distribution explains why some threats weigh more than others in the final risk analysis with Magerit calculation.

4. Threat identification and degradations

Magerit groups its threat catalogue into typologies: natural disasters [N], industrial origin [I], unintentional errors and failures [E] and deliberate attacks [A]. For each asset we select the relevant threats with their type degradation over the C, I, A dimensions:

# Example asset-threat matrix (extract)
Customer_DB
  [E.1] User error                       (d=C 5, d=I 5, d=A 7)
  [E.15] Information leakage             (d=C 9)
  [A.8] Malicious software spread        (d=C 4, d=I 6, d=A 8)
  [A.15] Social engineering              (d=C 6, d=A 5)
ERP_Server
  [I.8] Service failure                  (d=A 8)
  [A.6] Sabotage                         (d=A 9)
  [N.1] Fire                             (d=A 9)

Fig. 3 – Asset-threat matrix with standard degradations from the Magerit catalogue.

Materialization probability can be estimated with historical data or with the frequency scale offered by the guide. In PILAR you choose between qualitative or quantitative estimation; in our exercise we use the scale: 1 (rare) to 5 (almost certain).

The official catalogue exceeds one hundred coded threats. Expanding the SME’s matrix with common cases found in offices and small companies:

[E.28] Staff unavailability             (d=A 6)
[E.9]  Errors from other third parties   (d=C 4, d=I 5, d=A 6)
[E.23] Maintenance errors                (d=I 5, d=A 6)
[A.7]  Use of unauthorized material      (d=C 6, d=I 6)
[A.10] Abduction (extortion)             (d=C 8, d=A 8)
[A.11] Unauthorized access               (d=C 8, d=I 6, d=A 7)
[A.18] Information destruction           (d=I 9, d=A 8)
[I.5]  Physical or logical failure       (d=A 8)

Do not inflate the threat list: two or three well-chosen threats per asset beat twelve with irrelevant degradations. The Magerit v4 catalogue marks the adjustable “typical” degradations, and the analyst’s experience fine-tunes probability with real data from the organization.

5. Intrinsic and residual risk calculation

The intrinsic risk of an asset against a threat is calculated as: Risk = Impact x Probability, where impact combines the asset valuation and the suffered degradation. Magerit’s calculation annex defines specific tables; as a summary, the result is mapped to a 0-10 scale per asset:

Risk = max( C x dC , I x dI , A x dA ) x P

Risk_DB = max(10x9, 10x6, 10x8) x 4 = 90 x 4 = 360  -> HIGH RISK

Fig. 4 – Summarized risk calculation formula per asset-threat pair.

After applying existing safeguards (antivirus, firewall, backups) we reduce probability or effective degradation, obtaining residual risk. For Customer_DB, information leakage [E.15] is only substantially reduced with encryption and data classification safeguards, which the SME does not have yet.

In PILAR, the result appears on the valuation screen as a per-threat table with impact, probability and risk, colored like a traffic light. The milestone report compares iterations; for our SME the numbers would look like this:

Threat	Impact	Probability	Risk	Level
[E.15] Information leakage (DB)	9	3	270	High
[A.11] Unauthorized access (DB)	8	2	160	Medium
[I.8] Service failure (Server)	8	4	320	High
[N.1] Fire (Server)	9	1	90	Low

The table above reproduces what PILAR shows in its “risk per threat” screen: with an acceptance threshold of 200, risks above it enter the treatment plan and lower ones stay documented as accepted risk, signed by the responsible manager. For instance, the service failure threat on ERP_Server shows impact 8 x probability 4 = 320, above the threshold, while fire stays at 9 x 1 = 90, an accepted residual. Verify each calculation manually, as PILAR outputs hundreds of numbers and one wrong valuation propagates through the entire report.

6. Treatment plan and analysis conclusions

The treatment plan prioritizes high residual risks. For the SME in our case, the recommended actions were:

Implement daily backups with monthly restore verification (reduces I.8 on ERP_Server).
Encrypt backups and enable in-transit encryption for the CRM (reduces E.15 on Customer_DB).
Add MFA to VPN access and the ERP (reduces A.15 and A.6).
Quarterly cybersecurity awareness training (reduces E.1 and A.7).
Sign cyber liability insurance (transfer of residual risk).

6.1. Cost-benefit analysis of safeguards

The plan closes by comparing the cost of every safeguard with the risk it avoids, so management approves with numbers:

Safeguard	Annual cost	Risk avoided (EUR/year)	Priority
Daily backups with monthly restore check	3,000	45,000	High
Backup and CRM transit encryption	2,500	38,000	High
MFA for VPN and ERP	4,000	52,000	High
Quarterly awareness training	1,200	15,000	Medium
Cyber liability insurance	6,000	Partial transfer	Medium

6.2. ENS compliance with the Magerit analysis

All actions have positive return, which eases approval. Besides, risk analysis with Magerit feeds the ENS directly: it defines the system category (basic, medium or high), supports the statement of applicability under article 20 of RD 311/2022 and documents which residual risk is accepted and who accepts it. Running the analysis with PILAR automatically generates the table of applicable measures per Annex II of the scheme, the document every ENS certification auditor asks for first. Review the whole analysis at least yearly, or after major changes such as a new cloud migration, and keep the milestone report alongside the security policy to simplify the next audit.

7. Conclusion

Risk analysis with Magerit turns uncertainty into an ordered list of priorities: which assets to protect first, with which budget and with what justification. The methodology is rigorous, publicly documented by CCN-CERT and is the basis of the ENS, so its adoption in organizations operating in Spain has no real alternative.

At Jaymon Security we perform risk analysis with Magerit and ISO 27005 for organizations of every size, including ENS and GDPR compliance documentation. If your company does not yet know its critical risks, it is time to find out. Learn more at our contact page, or directly in the official Magerit v4 catalogue from CCN-CERT and the National Security Scheme guides.

Need help with Risk analysis with Magerit?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.