ARAT currently supports the methodology with two dimensional risk matrix, where the dimensions are Likelihood of incident scenario and Business Impact of Incident. Both dimensions have granularity of 5 levels, resulting in risk levels of 0-8. The granularity may be changes easily. The supported methodology is listed in ISO/IEC 27005:2008 under section E.2.1, table E.1.b.