Updating the VCDB Index Data for CIS RAM 2.1 & CIS RAM 2.2

Organizations using CIS RAM should periodically update their VCDB Index data to ensure threat expectancy calculations reflect the most current available incident information. This download provides the updated VCDB Index values derived from February 2026 VCDB data, along with detailed instructions for implementing the update in CIS RAM workbooks.

The guidance covers both CIS RAM 2.1 and CIS RAM 2.2. For CIS RAM 2.1, the update applies to risk registers based on CIS Controls v7.1 and v8.0, which share the same asset class associations. For CIS RAM 2.2, the guidance addresses the updated asset classification model introduced with CIS Controls v8.1, including changes to asset class mappings that can significantly affect expectancy scoring results.

The document includes:

• Updated Incident Count values.
• Revised Sum of Threat Count / Industry values by asset class.
• Step-by-step instructions for updating the VCDB Index table in the CIS RAM workbook.
• Guidance for handling asset class differences between CIS RAM 2.1 and 2.2.
• Information on the introduction of the Documentation asset class in CIS RAM 2.2 and its relationship to Data-based threat modeling.

Download this resource to keep your CIS RAM implementation aligned with the latest VCDB-derived threat frequency data and maintain consistency in your risk analysis calculations.