The cyber security formula-based risk evaluation method is outlined for using SCADA in Industrial Control System (ICS) of Critical National Infrastructure (CNI) plants. The main feature of the method is taking into account not only information security methods but all safety and security and reliability measures available. Another feature concerns assets definition by means of explicit and hidden functions for which damage values from feasible cyber-attacks are estimated. The method deals with the scales of order. An example of the scale is proposed for damage and risk values. The essence of the method, its application domain restrictions, the stages of risk management addressed, key risk management concepts covered are described in the paper.