Guides

Choose a tool

Needs, selection criteria and a detailed comparison of selected tools.

Hazard analysis

PHA — Preliminary hazard analysis: method and toolsPreliminary hazard analysis (PHA): identify hazardous situations early, rate risk and define first measures. Steps, pitfalls and software.Read the guide → HAZOP: method and softwareThe HAZOP method: nodes, parameters, guide words and process deviations. Steps, pitfalls and free and commercial HAZOP software.Read the guide → FMEA: method and softwareFMEA / FMECA (failure modes, effects and criticality analysis): failure modes, effects, severity, occurrence, detection. Steps and tools.Read the guide → Bow-tie: method and softwareThe bow-tie method: top event, threats, consequences, preventive and mitigating barriers. Software and references.Read the guide → Atmospheric dispersion modelling: method and toolsModel the dispersion of a toxic or flammable release: Gaussian plume, heavy gas, stability classes, threshold footprints. Principle, steps and software (Phast, Aurorisk).Read the guide → Explosion, fire and BLEVE: modelling thermal and overpressure effectsModel the effects of a vapour cloud explosion, a BLEVE or a fire (pool, jet, fireball): overpressure, heat flux, effect distances. Principle and software.Read the guide → Chemical hazards: reading an SDS and choosing a thresholdUnderstand a safety data sheet (SDS), choose between AEGL, ERPG and IDLH for an acute toxicity threshold, and know the reference databases (PubChem, CAMEO, INRS).Read the guide →

Reliability and system safety

Fault tree and event tree analysis: method and softwareFault tree analysis (FTA) and event tree analysis (ETA): AND/OR gates, minimal cut sets, top event probability, accident sequences. Steps and open-source software.Read the guide → STPA: method and toolsMIT’s STPA (System-Theoretic Process Analysis): losses, hazards, control structure, unsafe control actions. Free and open-source tools.Read the guide →

Risk quantification

LOPA — Layer of protection analysis: method and softwareLOPA (Layer of Protection Analysis): initiating event frequency, independent protection layers, probability of failure on demand and SIL. Steps and software.Read the guide → Monte Carlo simulation for risk analysisMonte Carlo simulation: propagate input uncertainty to a result (cost, schedule, probability, dose), read percentiles and sensitivities. Steps and software.Read the guide → FAIR: quantifying cyber risk in financial termsThe FAIR method (Factor Analysis of Information Risk): loss event frequency and loss magnitude, range estimates and simulation. Principle, steps and tools.Read the guide → Financial risk and Value at Risk (VaR): method and toolsMeasuring financial risk through scenarios and Value at Risk (VaR): historical, parametric and Monte Carlo approaches, stress testing. Steps and open-source software.Read the guide →

Cyber risk

EBIOS Risk Manager: method and softwareANSSI’s EBIOS Risk Manager method: five workshops, risk origins, strategic and operational scenarios, risk treatment. Labelled software and free tools.Read the guide → IEC 62443: OT risk analysis and industrial cybersecurityThe IEC 62443 series for industrial automation and control system (OT/ICS) cybersecurity: zones, conduits, security levels (SL) and risk analysis. Steps and tools.Read the guide → Threat modeling: method and toolsThreat modeling: data flow diagrams, STRIDE categories, attack trees. Steps, common pitfalls and free tools (OWASP Threat Dragon, MITRE ATT&CK).Read the guide → Vulnerability prioritisation: CVSS, EPSS and KEVPrioritise vulnerabilities with the CVSS severity score, the EPSS exploitation likelihood score and the catalogue of actively exploited vulnerabilities (KEV). Method and free calculators.Read the guide →

Occupational safety

DUERP: occupational risk assessment (France)The French single occupational risk assessment document (DUERP): work units, hazard identification, rating, action plan. Steps, obligations and software.Read the guide →

Continuity and resilience

Business continuity planning (BCP): method and guidesThe business continuity plan (BCP): business impact analysis (BIA), recovery time and point objectives (RTO/RPO), continuity and recovery strategies. Steps and references (ISO 22301).Read the guide →