RETACH Documentation

CRQ Methodology

The RETACH Cyber Risk Quantification Engine applies a frequency-severity actuarial model to produce financial loss estimates for organisations assessed under the S.I.N.S. Framework™. This document describes the full methodology — the model steps, the assumptions behind every constant, and the sources used to calibrate them.

How the model works — five steps

1. 01
   Count how often attacks happen (Frequency)

   Base attack probabilities for six scenario types — phishing, ransomware, financial fraud, data breach, business continuity failure, and insider threat — are drawn from published East Africa sector incident data. A sector multiplier adjusts for the relative attack frequency of the assessed organisation's industry: a Fintech faces attacks 2.4× more often than baseline; a SACCO 1.8×. A risk modifier derived from the organisation's control posture (MFA adoption, backup posture, ODPC status, S.I.N.S. score) adjusts the final likelihood downward where controls are in place.
2. 02
   Estimate how much each event costs (Severity)

   Severity is modelled as a percentage of annual revenue, because an organisation's revenue is the most reliable proxy for the scale of data held, transactions processed, and operational complexity. Ransomware typically costs 18% of annual revenue when it hits. A data breach costs 12%. These percentages are calibrated to East Africa incident cost data and validated against IBM Cost of a Data Breach 2023 and Zurich Insurance emerging markets loss data.
3. 03
   Multiply: Expected Loss = Frequency × Severity

   This is the same formula an insurance actuary uses to price a premium. If ransomware has a 30% annual probability and costs KES 9M when it hits, the expected annual loss from ransomware is KES 2.7M. The Engine calculates this for six attack types and sums them. That total is your Expected Annual Loss.
4. 04
   Model the distribution (Poisson-Lognormal)

   The EAL is the mean of a loss distribution, not a guarantee. Real losses follow a lognormal distribution — most years are cheaper than average, but occasionally an event is catastrophic. We use a Poisson-Lognormal model with sector-specific dispersion constants (σ) calibrated from Serianu and Zurich emerging markets data. This gives you the 50th percentile (Expected), 75th percentile (Adverse), and 95th percentile (Severe/Worst-Case) loss figures.
5. 05
   Add regulatory fine exposure

   For each sector, applicable Kenyan regulatory frameworks are assessed separately. The Kenya Data Protection Act 2019 (max KES 5M, ODPC) applies universally. Sector-specific regulators — CBK, SASRA, CA Kenya, ICT Authority, NC4 — add additional exposure. For Critical Infrastructure sectors, CMCA 2018/2024 s.18 adds up to KES 25M, creating a combined ceiling of KES 30M. These figures are modelled independently from the EAL and added to produce Total Risk Exposure.

Assumptions & limits

Every modelling assumption is listed here. Where a figure is an estimate rather than an empirical measurement, that is noted explicitly.

Calibration sources

The following published sources are used to calibrate sector multipliers, severity percentages, and control efficacy constants in the CRQ Engine.

CRQ Terms & EULA

By using the RETACH CRQ Engine, you agree to the following terms. These terms govern the use of all quantification outputs, reports, and models produced by RETACH Digital Ltd tools.

Engagement Templates

Standardised deliverable templates used across RETACH engagements. Download and use as the basis for client reporting.

S.I.N.S. Framework™

The S.I.N.S. Framework™ for Digital Resilience is a four-pillar methodology for building organisational resilience against digital risk. It is an implementation alignment layer that translates global standards (ISO 27001, NIST CSF, CIS Controls) into executable programmes for organisations without dedicated security teams.

The pillars are sequenced intentionally — each layer depends on the one before it. You cannot meaningfully govern security risks (Security) without knowing what infrastructure you have (Infrastructure). You cannot segment a network (Network) without managing what connects to it (Systems).

Critical Infrastructure Protection

The RETACH CRQ Engine models organisations in sectors designated as critical infrastructure under applicable law separately from general commercial sectors — with higher frequency multipliers, tighter RTO assumptions, and combined regulatory fine exposure reflecting both data protection and sector-specific cyber legislation.

RETACH's practice includes direct operational security experience inside critical national infrastructure — including enterprise network security, identity management, IRP, and BCP delivery in a mission-critical, geographically distributed environment. That practitioner background informs how the framework is calibrated for CI sectors.

Combined fine = DPA 2019 max KES 5M (ODPC) + CMCA 2018/2024 s.18 max KES 25M (NC4/DCI). Both penalties can be imposed simultaneously for the same security failure. CMCA s.18 also carries a custodial sentence of up to 20 years imprisonment. This does not constitute legal advice — validate with qualified Kenyan counsel.