Risk
Exposure banding and provenance
Where the exposure bands come from, what they are explicitly not derived from, and why the provenance is printed alongside the figure.
The provenance, as printed
The bands are GovIntel's own internal severity banding. They are not actuarial, are not derived from external breach-loss statistics, industry claims data or any third-party loss dataset, and are not a prediction of actual financial loss.
That statement is printed in the pack beside the figure, not buried in a methodology appendix.
What the banding represents
The relative governance priority of a control failure. Severity, not financial exposure.
The correction that produced this wording
An earlier version described the bands as the order of magnitude of remediation and incident-handling cost. That framing implied a costing the pack does not perform, and contradicted the pack's own statement that no financial, loss, likelihood, actuarial or probabilistic modelling is applied.
The banding itself was unchanged. Only its description was, because the description was the part that was false.
Why provenance is published at all
A number on a board page with no stated origin will be treated as a measurement. Publishing the origin is what lets a reader discount it appropriately.
What it does not mean
The bands are not benchmarked against anything, and their absolute values carry no external validation.