Background. In the field of risk management, focusing on digital infrastructure, there is an uncertainty about which methods and algorithms are relevant and correct. Behind this uncertainty lies a need for testing and evaluation of different risk management analysis methods in order to determine how effective they are in relation to each other.

Purpose. The purpose of this thesis is to manufacture a reproducible and universal method of comparison between risk management analysis methods. This is based on the need to compare two risk assessment analysis methods. One method relies solely on impact information and the other expands on that concept by also utilizing information about the network environment.

Method. A network is modeled into a scenario. A risk assessment is conducted on the scenario by risk assessment experts which will be used as the correct solution. The tested risk management analysis methods are applied to the scenario and the results are compared with the expert risk assessment. The distance between the assessments are measured with Mean Square Error; A smaller distance between one assessment and the experts assessment indicates that it is more correct.

Result. The result shows that it is possible to reproducibly compare risk management analysis methods by comparing the respective output with an established truth. The conducted comparison shows that a method that use network environment data is capable of producing a more correct assessment than one which simply uses impact data.

Conclusion. A scenario based approach to compare risk management analysis methods for risk assessment has been proven effective.