Description

This curriculum spans the full lifecycle of cyber risk assessment, comparable in scope to a multi-phase advisory engagement, covering scoping, asset criticality analysis, threat and vulnerability evaluation, risk quantification, treatment planning, and integration with enterprise risk management practices.

Module 1: Defining the Cyber Risk Assessment Scope and Objectives

Determine which business units, systems, and data classifications are in scope based on regulatory requirements and criticality to operations.
Select risk assessment standards (e.g., NIST SP 800-30, ISO 27005) that align with organizational compliance obligations and audit expectations.
Negotiate with stakeholders on acceptable risk tolerance thresholds before initiating assessments to prevent scope creep.
Identify and onboard key data owners and system custodians to validate asset inventories and ownership claims.
Decide whether to assess risk at the enterprise level, per business line, or per application based on resource constraints and governance maturity.
Establish criteria for excluding legacy systems from formal assessment due to operational constraints or decommission timelines.
Define whether the assessment will include third-party vendors and supply chain partners, and establish data-sharing agreements accordingly.
Document assumptions about threat actor capability and likelihood to standardize risk scoring across teams.

Module 2: Asset Identification and Criticality Classification

Map IT assets to business processes using CMDB or service dependency tools to justify criticality ratings.
Apply a classification schema (e.g., public, internal, confidential, restricted) based on data sensitivity and regulatory exposure.
Resolve discrepancies between IT asset records and business unit claims of data ownership using cross-functional workshops.
Implement automated discovery tools to detect shadow IT and unmanaged endpoints, then assign ownership.
Classify cloud workloads by deployment model (IaaS, PaaS, SaaS) to determine shared responsibility boundaries.
Flag assets subject to specific regulations (e.g., HIPAA, PCI-DSS) for enhanced control requirements and reporting.
Define refresh cycles for asset inventory updates to maintain assessment accuracy over time.
Integrate asset criticality scores into vulnerability management triage processes to prioritize patching.

Module 3: Threat Modeling and Actor Profiling

Select threat modeling methodologies (e.g., STRIDE, PASTA) based on system architecture and development lifecycle stage.
Profile threat actors (e.g., insider, script kiddie, APT) by motive, capability, and access level to calibrate likelihood estimates.
Map known adversary tactics, techniques, and procedures (TTPs) from MITRE ATT&CK to internal system architectures.
Adjust threat likelihood ratings based on sector-specific intelligence (e.g., ransomware trends in healthcare).
Validate threat scenarios with red team findings or penetration test results to avoid theoretical overreach.
Document assumptions about attacker entry points (e.g., phishing, exposed APIs) to support control design.
Update threat models following major infrastructure changes, such as cloud migration or M&A activity.
Coordinate with threat intelligence teams to integrate IOCs and TTPs into ongoing risk monitoring.

Module 4: Vulnerability Analysis and Exposure Assessment

Integrate vulnerability scanner outputs (e.g., Qualys, Tenable) with asset criticality to calculate exposure severity.
Adjust CVSS scores based on environmental factors, such as network segmentation or compensating controls.
Identify false positives through manual validation or automated correlation with configuration management tools.
Assess configuration drift in cloud environments using CSPM tools to detect unsecured storage buckets or open security groups.
Map unpatched systems to exploit availability and active threat campaigns to refine risk likelihood.
Document technical constraints preventing remediation (e.g., legacy software dependencies) for risk acceptance.
Correlate vulnerability data with user behavior analytics to detect exploitation attempts in progress.
Establish thresholds for critical exposure that trigger immediate incident response escalation.

Module 5: Likelihood and Impact Quantification

Calibrate likelihood ratings using historical incident data and industry breach statistics.
Define impact criteria across financial, operational, reputational, and compliance dimensions with business input.
Assign monetary values to data assets using business-validated cost models (e.g., cost of downtime per hour).
Apply quantitative models (e.g., FAIR) only where data quality supports credible loss distribution estimates.
Use ordinal scales (e.g., low/medium/high) when data is insufficient for probabilistic modeling.
Adjust impact scores for cascading effects, such as third-party service disruption or supply chain contagion.
Document rationale for all likelihood and impact judgments to support audit and review processes.
Reassess impact following organizational changes, such as entry into new markets or regulatory regimes.

Module 6: Risk Scoring and Prioritization Frameworks

Implement a risk matrix with defined thresholds for low, moderate, high, and critical risk categories.
Weight risk scores by asset criticality to ensure high-value systems dominate the risk register.
Normalize risk scores across departments to enable enterprise-level aggregation and reporting.
Adjust scoring algorithms to reflect organizational risk appetite (e.g., lower tolerance for data exfiltration).
Exclude residual risks below the organization’s de minimis threshold from active tracking.
Flag high-risk items with low remediation cost for immediate action to demonstrate governance effectiveness.
Integrate risk scores into executive dashboards with drill-down capability to underlying evidence.
Establish review cycles for risk score updates based on control implementation or threat changes.

Module 7: Control Evaluation and Gap Analysis

Map existing controls to recognized frameworks (e.g., CIS Controls, NIST CSF) to identify coverage gaps.
Assess control effectiveness through testing evidence, audit reports, or automated monitoring logs.
Distinguish between technical controls (e.g., MFA, EDR) and procedural controls (e.g., change management).
Identify compensating controls where primary controls are missing or ineffective.
Document control ownership and maintenance responsibilities to ensure accountability.
Assess control scalability under peak load or incident conditions (e.g., DDoS, mass phishing).
Validate cloud provider controls via SOC 2 reports or API-based assurance tools.
Flag controls with known bypass methods or documented exploitation in threat intelligence.

Module 8: Risk Treatment Planning and Remediation Strategy

Select risk treatment options (mitigate, transfer, accept, avoid) based on cost-benefit analysis and feasibility.
Develop remediation timelines with milestones for high-risk items, factoring in resource availability.
Negotiate risk acceptance with business owners, requiring documented justification and executive sign-off.
Procure cyber insurance for residual risks that cannot be cost-effectively mitigated.
Outsource risk treatment for specialized domains (e.g., penetration testing, SOC services) with SLA-defined outcomes.
Integrate remediation tasks into existing change management and project workflows to ensure execution.
Define success metrics for control implementation (e.g., patch compliance rate, phishing click rate reduction).
Escalate stalled remediation efforts to governance committees after predefined time thresholds.

Module 9: Continuous Monitoring and Risk Reporting

Integrate risk indicators (e.g., unpatched systems, failed access attempts) into SIEM and SOAR platforms.
Automate risk metric collection from vulnerability scanners, GRC tools, and identity systems.
Establish thresholds for risk metric anomalies that trigger alerting and investigation workflows.
Produce board-level risk reports with trend analysis, top risks, and treatment progress.
Conduct quarterly risk review meetings with business and IT leaders to reassess priorities.
Update risk assessments following significant events (e.g., breach, audit finding, system deployment).
Archive historical risk data to support trend analysis and regulatory reporting.
Validate monitoring coverage by comparing risk register items to active telemetry sources.

Module 10: Integration with Enterprise Risk Management (ERM)

Map cyber risk categories to enterprise risk taxonomy to enable aggregation with financial and operational risks.
Align cyber risk appetite statements with overall ERM framework and board-level risk tolerance.
Participate in enterprise risk committee meetings with standardized reporting formats and metrics.
Coordinate cyber risk disclosures with legal and compliance teams for SEC, GDPR, or other regulatory filings.
Integrate cyber risk scenarios into enterprise-wide business continuity and crisis management planning.
Share threat intelligence and risk trends with internal audit for coordinated assurance planning.
Support internal audit with documented risk assessment procedures and evidence trails.
Adjust cyber risk strategy based on enterprise strategic shifts (e.g., digital transformation, divestitures).