> For the complete documentation index, see [llms.txt](https://docs.securemetrics.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securemetrics.io/cyber-risk-quantification-crq-pro/excel-model.md).

# Excel Model

{% hint style="warning" %}
The CRQ Pro Excel Model requires Python in Excel. The model does NOT require the paid version (known as the add-in). The standard version included in all M365 subscriptions is sufficient. 
{% endhint %}

<figure><img src="/files/iO3RPrmXEFkSdDKY8v9R" alt=""><figcaption></figcaption></figure>

## Locked Sheets

{% hint style="info" %}
There is no password on the locked sheets and workbook
{% endhint %}

The CRQ Pro Excel Model's workbook structure and sheets are locked to minimize the liklihood of introducing errors when loading into PowerBI. The PowerBI reporting requires specific output structures.&#x20;

This is not to lock you out of editing or reviewing these sheets. You can unlock the sheets, but please note that changing the output or input structure can break both the Python code and PowerBI reporting.&#x20;

## Workbook Structure

| Sheet Name      | Purpose                                                              | Hidden |
| --------------- | -------------------------------------------------------------------- | ------ |
| Model           | Model input including scenario information and FAIR model variables  |        |
| Output          | Quick statistical output to quickly validate model inputs            |        |
| Results         | Python code that runs Monte Carlo simulations                        | ✅      |
| LEC             | Python code that generates exceedence curve data                     | ✅      |
| Statistics      | Python code that generates statistical measure table                 | ✅      |
| Statistics Flat | Python code that generates statistical measures in single row format | ✅      |
| Notes           | Structured output for notes and assumptions                          | ✅      |

## Model Sheet

The model sheet is where you will enter your model inputs and meta data. The cells requiring data input are highlighted in blue:

| Input                          | Description                                                                                             | Example                         | Required |
| ------------------------------ | ------------------------------------------------------------------------------------------------------- | ------------------------------- | -------- |
| Scenario                       | Name/description of the risk scenario being modeled                                                     | Inappropriate access privileges |          |
| Analyst                        | Name, email, or other identifier of the analyst                                                         | Mitchell Telatnik               |          |
| Date                           | Date the model was performed                                                                            | 01/01/2025                      |          |
| Model Name                     | Name of the model. This acts as a unique identifier. Recommended to use an organization-defined schema. | Model-01                        |          |
| Asset at Risk                  |                                                                                                         | Customer PII                    |          |
| Threat Community               |                                                                                                         | Cyber criminals                 |          |
| Threat Type                    |                                                                                                         | Malicious                       |          |
| Effect                         |                                                                                                         | Confidentiality                 |          |
| Threat Event Frequency         |                                                                                                         | 0.5 ; 15                        | ✅        |
| Vulnerability                  |                                                                                                         | 5%                              | ✅        |
| Secondary Loss Event Frequency |                                                                                                         | 80%                             | ✅        |
| Loss Magnitude Variables       |                                                                                                         | 20,000                          | ✅        |