I’m the person who got handed compliance. I’m organised but I’m not a security specialist. Is a risk-quantification tool going to be over my head?
You don’t need to be a specialist. You need to be able to describe your business and answer plain questions about it. The method does the maths; your job is the context (“this is what we’d lose if this system went down for a day”, “this is who has access”).
That’s the whole point of the “accidental compliance owner” being a real audience: the hard, specialist part (the modelling, the control mapping) is carried for you; the part only you can do (what matters to your business) is asked in plain language. If a step ever assumes knowledge you don’t have, that’s a bug in the explanation, not a gap in you. Flag it here and we’ll get it fixed.