Risk categories (RC01–RC11)
The 11 risk categories, how many controls each aggregates, and how each Risk Score is computed.
The 11 risk categories
Aranis maps controls to 11 risk categories (RC01–RC11) in an N:N relationship — a single control can belong to several categories. There are currently 378 control×category pairs. Each category's Risk Score is computed separately, which shows you where your supplier portfolio concentrates exposure.
Code | Category | Controls |
|---|---|---|
RC01 | Credentials | 12 |
RC02 | Data | 17 |
RC03 | Continuity | 11 |
RC04 | Supply Chain | 23 |
RC05 | Critical Infrastructure | 71 |
RC06 | Access | 15 |
RC07 | Privacy | 52 |
RC08 | Social Engineering | 5 |
RC09 | Vulnerabilities | 19 |
RC10 | Governance | 87 |
RC11 | AI & Model Risk | 66 |
These are the short labels used in the product's charts. The taxonomy's long-form names are currently maintained in Portuguese only — RC01, for example, is registered as Comprometimento de Credenciais.
RC10 — the category that multiplies the others
RC10 is not just another category: it is flagged as the governance multiplier. Maturity across the GV.* controls is normalized into GV_norm and applied as a credibility factor over every other score: AdjustedMaturity = Maturity × (1 − 0.20 × (1 − GV_norm)). The 0.20 factor is configurable per organization. When GV_norm falls below 0.40, the report emits an explicit alert that the remaining scores may not be sustainable — the premise being that a supplier with no governance program cannot hold other controls in place consistently.
RC07 uses a synthetic CVSS
Most categories weight probability by each control's real CVSS. RC07 is the exception: privacy and compliance controls have no associated CVE, so they have no real CVSS. For that category the system uses a fixed synthetic weight (7.5 by default), configurable per organization. In the other categories, a control with no CVSS data enters at the 5.0 default.
How a category's Risk Score is computed
For each category the system gathers the answers to the controls mapped to it, discarding those marked NA. Raw probability is the share of NO answers over that total, weighted by severity: WeightedProb = RawProb × (avgCVSS ÷ 10), where avgCVSS considers only the NO answers.
Impact starts at a floor set by the supplier profile (P1 = 0.25, P2 = 0.50, P3 = 0.75) and climbs toward 1.0 according to the severity of that category's own gaps, measured by the p95 of the CVSS of its NO answers. This is deliberate: one critical gap should move impact more than several low-severity ones — hence p95 rather than an average.
Both values are then classified into dynamic quartiles from 1 to 4 (ProbRef and ImpactRef) and combined: Risk Score = 0.40 × (ProbRef ÷ 4) + 0.60 × (ImpactRef ÷ 4), yielding a number between 0 and 1. Both weights are configurable; the default favors impact because potential business damage matters more than how often gaps occur.