RETACH Documentation

CRQ Methodology

The RETACH Cyber Risk Quantification Engine applies a frequency-severity actuarial model to produce financial loss estimates for organisations assessed under the S.I.N.S. Framework™. This document describes the full methodology — the model steps, the assumptions behind every constant, and the sources used to calibrate them.

How the model works — five steps

1. 01
   Count how often attacks happen (Frequency)

   Frequency is modelled as a Poisson process — the standard actuarial way to count how many events happen per year. A national base rate (λ = 0.462 incidents/organisation/year) comes from the Serianu Africa Cybersecurity Report 2024/25 (37% of surveyed Kenyan organisations reported at least one incident that year). This base rate is adjusted by a sector multiplier (a Fintech faces attacks 2.4× more often than baseline; a SACCO 1.8×), split across six S.I.N.S. scenario types by relative frequency, then reduced by a control-posture modifier — MFA adoption, backup posture, ODPC status, RETACH Academy enrolment, and overall S.I.N.S. score — where controls are in place.
2. 02
   Estimate how much each event costs (Severity)

   Severity is modelled as a percentage of annual revenue, because an organisation's revenue is the most reliable proxy for the scale of data held, transactions processed, and operational complexity. Ransomware typically costs 18% of annual revenue when it hits. A data breach costs 12%. These percentages are calibrated to East Africa incident cost data and validated against IBM Cost of a Data Breach 2025 and Zurich Insurance emerging markets loss data.
3. 03
   Multiply: Expected Loss = Frequency × Severity

   This is the same formula an insurance actuary uses to price a premium. If ransomware has a Poisson rate of λ = 0.3 events/year and costs KES 9M on average when it hits, the expected annual loss from ransomware is KES 2.7M (the likelihood shown on-screen is P(at least one event this year) = 1 − e^−λ ≈ 26%, not a flat annual probability). The Engine calculates this for six attack types and sums them. That total is your Expected Annual Loss.
4. 04
   Model the distribution (Poisson-Lognormal)

   The EAL is the mean of a loss distribution, not a guarantee. Real losses follow a lognormal distribution — most years are cheaper than average, but occasionally an event is catastrophic. We use a compound Poisson-Lognormal model with sector-specific dispersion constants (σ) calibrated from Serianu and Zurich emerging markets data. The 75th and 95th percentile bands are derived by moment-matching the aggregate loss distribution across all six scenarios to a single lognormal curve, centred on the credibility-weighted headline EAL — an analytical (closed-form) method, not a Monte Carlo simulation; full Monte Carlo simulation is reserved for the paid tier. This gives you the mean (Expected), 75th percentile (Adverse), and 95th percentile (Severe/Worst-Case) loss figures.
5. 05
   Add regulatory fine exposure

   For each sector, applicable Kenyan regulatory frameworks are assessed separately. The Kenya Data Protection Act 2019 (max KES 5M, ODPC) applies universally. Sector-specific regulators — CBK, SASRA, CA Kenya, ICT Authority, NC4 — add additional exposure. For Critical Infrastructure sectors, CMCA 2018/2024 s.18 adds up to KES 25M, creating a combined ceiling of KES 30M. These figures are modelled independently from the EAL and added to produce Total Risk Exposure.

Assumptions & limits

Every modelling assumption is listed here. Where a figure is an estimate rather than an empirical measurement, that is noted explicitly.

Calibration sources

The following published sources are used to calibrate sector multipliers, severity percentages, and control efficacy constants in the CRQ Engine.

CRQ Terms & EULA

By using the RETACH CRQ Engine, you agree to the following terms. These terms govern the use of all quantification outputs, reports, and models produced by RETACH Digital Ltd tools.

Engagement Templates

Standardised deliverable templates used across RETACH engagements. Download and use as the basis for client reporting.

S.I.N.S. Framework™

The S.I.N.S. Framework™ for Digital Resilience is a four-pillar methodology for building organisational resilience against digital risk. It is an implementation alignment layer that translates global standards (ISO 27001, NIST CSF, CIS Controls) into executable programmes for organisations without dedicated security teams.

The pillars are sequenced intentionally — each layer depends on the one before it. You cannot meaningfully govern security risks (Security) without knowing what infrastructure you have (Infrastructure). You cannot segment a network (Network) without managing what connects to it (Systems).

Critical Infrastructure Protection

The RETACH CRQ Engine models organisations in sectors designated as critical infrastructure under applicable law separately from general commercial sectors — with higher frequency multipliers, tighter RTO assumptions, and combined regulatory fine exposure reflecting both data protection and sector-specific cyber legislation.

RETACH's practice includes direct operational security experience inside critical national infrastructure — including enterprise network security, identity management, IRP, and BCP delivery in a mission-critical, geographically distributed environment. That practitioner background informs how the framework is calibrated for CI sectors.

Combined fine = DPA 2019 max KES 5M (ODPC) + CMCA 2018/2024 s.18 max KES 25M (NC4/DCI). Both penalties can be imposed simultaneously for the same security failure. CMCA s.18 also carries a custodial sentence of up to 20 years imprisonment. This does not constitute legal advice — validate with qualified Kenyan counsel.