View source for EBIOS

{{Short description|Risk evaluation method in computer science}}
{{Expand French|Expression des besoins et identification des objectifs de sécurité|date=October 2011}}
'''EBIOS''' ('''E'''xpression des '''B'''esoins et '''I'''dentification des '''O'''bjectifs de '''S'''écurité - Expression of Needs and Identification of Security Objectives) is a method for [[analysis]], evaluation and action on risks relating to [[information system]]s.  It generates a security policy [[adapted]] to the needs of an organization. The method was created in 1995 and is now maintained by the [[Agence nationale de la sécurité des systèmes d'information|ANSSI]], a department of the [[French Prime Minister]].
The five steps of the EBIOS method are:
# Circumstantial study - determining the context;
# Security requirements;
# Risk study;
# Identification of security goals; and
# Determination of security requirements.
EBIOS is primarily intended for governmental and commercial organizations working with the [[Minister of Defence (France)|Defense Ministry]] that handle confidential or secret defense classified information. It enables well informed security actions to be undertaken. The objective is to assess and prepare for possible future situations (in the case of a newly created information system), and identify and respond to deficiencies (when the system is operating) in order to refine the security arrangements.
In its first version, EBIOS was focused on “security objectives redaction”. Since 2000, ANSSI became aware of improvements in international standards ([[International Organization for Standardization|ISO]] in particular) and “engaged EBIOS adaptation to this criteria”. It might also be viewed as a way to avoid France’s introspective approach to [[information security]], responding to the limitations of French methods that are not recognized abroad and are unsuited to international markets.
==References==
* [https://web.archive.org/web/20070903140101/http://www.ssi.gouv.fr/en/confidence/ebiospresentation.html System Security Information]
* [https://www.enisa.europa.eu/topics/threat-risk-management/risk-management/current-risk/risk-management-inventory/rm-ra-tools/t_ebios.html European Network and information security agency]
== External links ==
* [https://www.ssi.gouv.fr/guide/ebios-risk-manager-the-method/ EBIOS risk manager guide (english)]
* [https://www.ssi.gouv.fr/guide/ebios-2010-expression-des-besoins-et-identification-des-objectifs-de-securite/ EBIOS 2010 - Agence Nationale de la Sécurité]
* [http://www.isdecisions.com/en/compliance/methodological/ebios.cfm Isdecisions]
* [https://web.archive.org/web/20070816153825/http://www.cases.public.lu/publications/analyse_de_risques/La_methode_EBIOS/index.html Portail de la securite de lìnformation]
[[Category:Risk analysis methodologies]]