EBIOS

EBIOS (Expression des Besoins et Identification des Objectifs de Sécurité - Expression of Needs and Identification of Security Objectives) is a method for analysis, evaluation and action on risks relating to information systems. It generates a security policy adapted to the needs of an organization. The method was created in 1995 and is now maintained by the ANSSI, a department of the French Prime Minister.

The five steps of the EBIOS method are:

1. Circumstantial study - determining the context;
2. Security requirements;
3. Risk study;
4. Identification of security goals; and
5. Determination of security requirements.

EBIOS is primarily intended for governmental and commercial organizations working with the Defense Ministry that handle confidential or secret defense classified information. It enables well informed security actions to be undertaken. The objective is to assess and prepare for possible future situations (in the case of a newly created information system), and identify and respond to deficiencies (when the system is operating) in order to refine the security arrangements.

In its first version, EBIOS was focused on “security objectives redaction”. Since 2000, ANSSI became aware of improvements in international standards (ISO in particular) and “engaged EBIOS adaptation to this criteria”. It might also be viewed as a way to avoid France’s introspective approach to information security, responding to the limitations of French methods that are not recognized abroad and are unsuited to international markets.