Semi-quantitative scoring uses numbers, such as 0 to 100 or 1 to 10, that map to labels like low and very high. The numbers allow finer ranking than a plain label, but they are not measurements. A score of 70 is not "twice" a score of 35 in any financial sense.
What NIST says
NIST SP 800-30 describes semi-quantitative methods as using bins, scales or representative numbers whose values and meanings are not maintained in other contexts. Its examples are bins of 0 to 15, 16 to 35, 36 to 70, 71 to 85 and 86 to 100, or a scale of 1 to 10. The bins translate to qualitative terms, so a score of 95 reads as very high, while still letting you compare risks within and across bins.
NIST gives a useful illustration: the difference between scores of 70 and 71 is relatively insignificant, while the difference between 36 and 70 is relatively significant.
Why use it
- You get a more detailed ranking than five labels allow.
- You can still communicate with simple words.
- It is quicker than building money models for every risk.
NIST notes that when scales provide enough granularity, relative prioritization is better supported than with a purely qualitative approach.
Where it goes wrong
The role of expert judgment is more visible than in a fully quantitative approach, and rigor drops when subjective calls are buried in the scores or when uncertainty is high. Typical problems:
- Weighted formulas that look scientific but hide arbitrary weights.
- Scores averaged across factors with unrelated meanings.
- Two decimal places on a guess.
- Teams treating a rank order as a probability.
How to build one that holds up
- Choose the factors. For example likelihood of attack, ease of exploitation, asset value, and impact on operations.
- Define the bins in words. Each bin needs an example, so two raters land in the same place.
- Pick a combination rule and write it down. Show it to the people who will use the scores.
- Test it on known incidents. Do the ratings agree with what actually hurt you?
- Keep the rationale. One sentence per score is enough.
NIST also expects each organization to define its own risk model, meaning which factors count and how values are combined, so treat any sample scale as a starting point.
When to stay simpler
Early in a system's life, information on threats and weaknesses is vague. NIST suggests a qualitative assessment with only a few factors may suit that stage, and a semi-quantitative scale suits an assessment informed by control testing, where estimates have more fidelity.
Quick check
Is a 0 to 100 score a probability?
No. It is an ordered label with finer steps. A probability needs its own definition and data.
Do I need all five bins?
No. Use as many as your raters can tell apart reliably, and define each one.
Sources
Last reviewed: 19 October 2026.
