1. A method comprising: obtaining information defining a rule by a risk manager system, the rule identifying a cyber-security risk to a computing device in an industrial process control and automation system; presenting a textual description describing the rule to a user by the risk manager system, the textual description including a selectable configuration parameter associated with the rule; receiving the user's selection of the configuration parameter by the risk manager system; and in response to receiving the user's selection of the configuration parameter, receiving a value associated with the configuration parameter from the user by the risk manager system.