Quantifying Cyber Risk Without Revenue to Lose

A public body has no revenue to lose, no share price to move and no insurance market pricing it the way one prices a manufacturer. It faces the same regulatory pressure to quantify cyber exposure as anyone else, and the standard model's central input does not exist.

‍

Substituting the loss categories is the easy half and it is where most guidance stops. The harder question is what the resulting figure is for, because the decisions a private company makes with it are mostly unavailable.

‍

What Replaces Lost Revenue?

‍

Four categories, all measurable, and together they usually produce a larger figure than people expect.

‍

Idled labor is the most direct. Staff who cannot work during an outage are paid regardless, so headcount multiplied by loaded cost multiplied by duration is a real and defensible number. Manual workaround cost sits alongside it, since paper processes and re-entry consume more hours than the systems they replace, frequently for weeks after service resumes.

‍

Recovery cost is the third and it runs higher than the private-sector equivalent for two structural reasons. Procurement rules prevent buying capability quickly, and legacy systems frequently have to be rebuilt rather than restored. Citizen remediation completes the set, covering identity monitoring at population scale and the litigation that follows exposure of records people had no choice about providing. Sector use cases differ mostly in which of these dominates.

‍

Which Unit Should the Figure Be Reported In?

‍

More than one, because a single currency figure lands badly in a public setting in a way it does not in a company.

‍

Service days lost, citizens affected and outage duration are all readable by the audiences a public body answers to, and each converts to cost without leading with it. A currency figure alone invites the objection that the organization is pricing a public service, which is a poor argument to have and an easy one to avoid by reporting the operational unit first and the financial one beneath it.

‍

Which Unit Travels Furthest?

‍

Duration, in most cases. The likelihood of an outage exceeding a working day is a statement anyone can act on and it carries the same information as a currency figure without the framing problem. The same distribution read two ways produces both from one model.

‍

What Cannot Be Priced Here?

‍

Statutory duty, and forcing a figure onto it costs credibility rather than gaining precision.

‍

An obligation to provide a service has no market price. Where a public body must issue a document, process an application or maintain a register, the cost of failing has legal and constitutional dimensions that a loss model does not represent. Naming that category and leaving it unpriced is more defensible than assigning a convenient number, and it is also more honest about what the exercise produces.

‍

Does That Weaken the Analysis?

‍

No, provided the omission is stated. A figure covering the measurable categories with the unmeasurable ones named is complete as a statement about what was measured. The failure mode is a figure presented as total exposure that quietly excludes the obligations the organization exists to discharge, which what a modeled figure cannot tell you covers as a general limit.

‍

What Is the Figure For?

‍

Public sector quantification diverges most here and where most guidance stops short. A private company uses an exposure figure to decide three things, and a public body can act on roughly one of them.

‍

Risk transfer is largely unavailable, since the market that prices commercial cyber exposure does not price public bodies the same way and some cannot purchase cover at all. Reallocation is constrained, because budgets are appropriated in a prior cycle by somebody else and moving money between lines is a process rather than a decision. Control investment remains, and even that competes within a fixed envelope.

‍

So the Purpose Inverts

‍

A private company asks what it should spend given the exposure. A public body more usefully asks what the current funding level leaves unaddressed, which turns the exercise from an allocation tool into an appropriation instrument. The output is a statement about residual exposure at present funding rather than a recommendation to spend, and that is a different document with a different audience.

‍

Who Reads It?

‍

Three audiences with different questions, and a single report satisfying all three is unlikely.

‍

• The accounting officer or equivalent: Wants to know whether the organization is discharging its duty of care, in terms that survive an audit.
• The funding body: Wants the marginal effect of additional money, expressed as exposure removed per unit spent.
• Oversight and audit: Wants the method, the assumptions and whether the figure is reproducible.

‍

The second is the one worth building for, because it is the conversation with an outcome. An exposure figure with no marginal analysis attached tells a funding body that the risk is large and gives it nothing to decide, whereas a ranked list of what each increment would remove is a request somebody can approve in part, which risk-focused prioritization produces.

‍

Does the Frequency Side Work at All?

‍

Better than for most private organizations, which is a genuine advantage worth using.

‍

Public bodies are frequently targeted for reasons that are well documented, incident disclosure in the sector is comparatively good in several jurisdictions, and peer organizations are structurally similar in a way private companies rarely are. A municipality can find comparators that resemble it closely on population served, service mix and system estate, which makes the frequency term better supported than the equivalent for a business in a niche market, and peer benchmarking works more cleanly here than elsewhere.

‍

Where Does the Comparison Break?

‍

On control state, which varies enormously between bodies of similar size because funding has varied enormously. Two municipalities serving comparable populations can sit in very different positions, so borrowing a peer's frequency without adjusting for the control difference imports their posture rather than their profile.

‍

What About Shared Infrastructure Between Bodies?

‍

A structural feature of the sector with no clean private-sector analogue, and it changes the aggregate materially.

‍

Public bodies frequently share identity platforms, payment processing, case management systems and hosting arrangements procured centrally. A failure in a shared service affects every body depending on it simultaneously, so an individual organization modeling its own exposure in isolation is describing a fraction of an event that would arrive as a sector incident. The dependency is usually documented, since it was procured centrally, which makes it easier to establish than a commercial supply chain, and concentration you cannot diversify away describes the position it creates.

‍

Who Should Model the Shared Component?

‍

Whoever procured it, and frequently nobody does. The central body holds the contract and the individual organizations hold the consequence, which is a distribution of accountability that leaves the aggregate unowned, and correlation across shared dependencies behaves the same way whether the dependency is commercial or public.

‍

What Can an Individual Body Do About It?

‍

Record the dependency and state the assumption. An exposure figure noting that a named shared service is a single point of failure, and that the model treats its failure as affecting this organization alone, is honest about a limit somebody above it should address. It also creates the record that the point was raised, which matters when the shared failure eventually happens.

‍

What Should the First Exercise Cover?

‍

Service continuity rather than data, which is the opposite of where private-sector modeling usually starts.

‍

A public body's most likely serious event is an outage that stops a service people depend on, and that is also the loss it can measure most reliably from its own data. Staff numbers, service volumes and processing times are known. Beginning with duration and idled capacity produces a defensible figure quickly, and the data exposure categories can be added afterward. Cyber risk quantification, or CRQ, works from the same industry loss data here as anywhere, with severity built from operational inputs rather than from revenue.

‍

Substitute the Inputs, Then Change the Question

‍

Replacing lost revenue is straightforward, since idled labor, manual workarounds, recovery at procurement speed and citizen remediation are all measurable and together usually exceed expectations. Statutory duty is not priceable and should be named rather than estimated. What differs more than the inputs is the purpose, because risk transfer is largely unavailable and reallocation is constrained, so the useful output is what present funding leaves unaddressed rather than what the organization should spend. Reporting duration and citizens affected alongside the currency figure avoids an argument nobody needs to have. Kovrr's CRQ builds severity from operational inputs, which is the substitution this sector requires.

‍

To see exposure modeled from service continuity and staffing inputs rather than from revenue, book a demo with our risk experts.