Why a decision discipline is needed

Findings accumulate. Decisions remain unresolved.

Without a disciplined chain, appetite and tolerance become late-stage labels, technical evidence cannot be compared economically, and protection choices are difficult to authorize. RDCD restores the correct order.

See the RDCD order ↓Frame an RDCD decision ↗

Establish requirementsBusiness value · appetite · tolerance

Trace inside-outCritical assets → threat paths → protection capabilities

Test the decisionBaseline → residual exposure → authority

Follow the full RDCD order below, then explore the animated acceptance decision.

The RDCD order

Appetite and tolerance are governance inputs, established by management near the start—not a late checkpoint after quantification.

SYSTEM A

Risk + protection requirements

Define what matters and how much risk management is prepared to carry.

Organizational activitiesIdentify and initially prioritize

Business value, appetite + toleranceAssign strategic attributes and measurable limits

Critical assets + asset attributesTrace the activity’s dependencies

Threat community + path/actionsBuild credible loss scenarios inside-out

Quantify baseline material riskFAIR frequency + FAIR-MAM magnitude distributions

SYSTEM B

Protection engineering

Design and compare the capabilities that can change the quantified exposure.

Protection strategyPrioritize FAIR-CAM loss-event control functions

Capabilities + safeguardsDesign people, process, and technology inside-out

Quantify residual risk + economicsRerun FAIR/FAIR-MAM and compare lifecycle alternatives

SYSTEM C

Governance + assurance

Authorize, maintain, and revisit the decision as conditions change.

Decision authorityRecord rationale, owners, commitments, and conditions

Iterate + reprioritizeMonitor evidence, triggers, performance, and tolerance

The quantitative spine

Baseline → capability effect → residual risk.

Loss-exceedance curves keep the message simple: establish current exposure, model how capabilities change it, then test residual exposure against management tolerance and lifecycle cost.

Loss exceedance curves showing current and residual exposure — **White: baseline**Silver: protection alternativeDashed curve: protection alternative

Learn the chain while doing the work

Every RDCD step can be delivered as an applied course, workshop, coached analysis, or train-the-practitioner module using the organization’s own decision context.

Executive governance

Set value, attributes, appetite, tolerance, decision rights, and review conditions.

Quantitative analysis

Build FAIR scenarios, estimate distributions, calibrate evidence, and communicate uncertainty.

Protection engineering

Use FAIR-CAM and inside-out design to translate risk requirements into capabilities.

See all training modules →

A clear next move

Start with the decision and the activity it must protect.

Marcriis will shape the right combination of consulting, quantitative analysis, engineering, and capacity building.

Start the brief ↗