Abstract: A computer implemented method for managing risk, which can include determining an organizational impact score from an aggregate of scenario impact scores and storing the organizational impact score in a memory of the computer. Some embodiments include calculating a likelihood score based upon an analysis of threats, imminence of each threat, and a likelihood associated with each threat, and storing the likelihood score in a memory of the computer. In some embodiments, an organizational maturity score is determined based on the ability of the organization to mitigate the actions of a potential threat and recover from a given scenario, and the organizational maturity score is stored in a memory of the computer. Some embodiments include calculating a Risk Index using a processor of the computer wherein the Risk Index equals the impact score multiplied by the likelihood score and divided by the maturity score.