Description

A focused course, tailored for you

Cyber Risk Quantification for Partner-Led Client Engagements

Build the cross-regulatory risk model your board clients can actually act on, from NIS2 and DORA to sector-specific obligations.

Your client's board wants one defensible cyber risk number that maps to their regulatory obligations. The gap between the technical assessment your team delivers and the board-ready artefact they need to table is costing you the follow-on work.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

A Cyber Security Partner running multi-sector client engagements faces a recurring delivery problem: the risk assessment is rigorous, the controls analysis is thorough, but the output does not survive the boardroom. The board wants a quantified position that speaks to NIS2 incident thresholds, DORA operational resilience requirements, ISO 27001 scope, and their sector regulator's materiality criteria, all in the same breath. Translating that into a single client-presentable artefact is not a technical problem, it is a methodology problem. Most teams solve it ad hoc, per engagement, burning senior hours on what should be a replicable build. This course gives you the architecture and the templates to standardise it across your practice.

What you walk away with

Build a cyber risk quantification model that maps a client's control posture to NIS2, DORA, ISO 27001, and relevant sector obligations in a single scoring architecture.
Produce the three client-facing artefacts a board risk committee needs: a heat map, a materiality statement, and a prioritised action register.
Reduce the senior-hour cost of translating technical assessments into board-ready deliverables by standardising the methodology across engagements.
Identify and close the narrative gaps that cause boards to return the risk slide rather than accept it.
Deploy the methodology as a repeatable practice asset your team can execute consistently across clients and sectors.

The 12 modules

Module 1. The Board's Real Question

Boards do not reject risk slides because they are technically wrong. They reject them because they do not answer the question the risk committee actually has: how exposed are we, relative to what our regulator and our sector peers accept as tolerable? This module maps the gap between a standard risk assessment output and a board-ready risk position, and defines the three questions every deliverable must answer before it survives the boardroom.

Module 2. Anatomy of a Cross-Regulatory Risk Score

A single risk score that spans NIS2 incident reporting obligations, DORA operational resilience thresholds, and ISO 27001 control requirements needs a scoring architecture, not a summary paragraph. This module builds the multi-axis scoring model from the ground up: what each regulatory regime contributes to the score, how conflicts between regimes are resolved, and how sector-specific materiality criteria are weighted into the final position.

Module 3. NIS2 Obligation Mapping for the Risk Model

NIS2 imposes incident reporting thresholds, supply chain security obligations, and governance accountability requirements that do not translate neatly into an ISO 27001 risk register. This module covers how to extract the NIS2 obligations that are material to your client's sector classification, map them to the control inventory, and represent the gap in the scoring architecture without duplicating effort from the technical assessment.

Module 4. DORA Resilience Requirements as Risk Inputs

DORA's operational resilience requirements introduce a dimension most cyber risk models underweight: the third-party ICT dependency chain. This module covers how to incorporate DORA's critical function mapping, the ICT concentration risk criteria, and the resilience testing obligations as inputs to the client risk score, particularly for financial sector clients where DORA is a primary regulatory driver alongside NIS2.

Module 5. Sector Regulator Materiality Thresholds

A financial services client, a healthcare operator, and a critical infrastructure operator read the same risk score against entirely different materiality baselines. This module builds the sector-calibration layer: how to identify the sector regulator's published materiality criteria, how to express your client's position relative to that baseline, and how to present sector-peer context without breaching confidentiality or making claims the data does not support.

Module 6. Building the Heat Map Your Client Can Table

The heat map is the artefact boards understand fastest and misinterpret most easily. This module covers the construction rules that prevent misinterpretation: axis labelling that maps to regulatory language, colour calibration against materiality thresholds rather than absolute severity, and the supporting annotation that explains what each cell means for the board's specific decision. Includes a reusable template adaptable across sectors and regulatory contexts.

Module 7. Writing the Materiality Statement

The materiality statement is the one-page document that sits above the heat map and tells the board whether their current position is acceptable, borderline, or requires immediate escalation under the relevant regulatory framework. This module covers the structure, the language register, and the citation discipline that makes the statement defensible in a regulatory review, not just persuasive in a boardroom. Covers NIS2, DORA, and sector-specific variants.

Module 8. The Prioritised Action Register

The action register is where the board risk committee decides who owns what and by when. A register that lists 47 controls in severity order is not actionable. This module covers how to collapse the technical findings into the five to eight decisions the board can actually make, how to frame each decision in terms of regulatory obligation and residual risk, and how to structure ownership and timeline in a way that survives the governance process without constant re-explanation.

Module 9. The Partner Narrative Layer

The documents do not present themselves. The partner narrative is the 10-minute oral brief that lands the deliverable correctly: what the score means, what changed since the last cycle, what the board's three options are, and what you recommend. This module covers the narrative structure, the objection patterns that arise when risk scores are presented to board risk committees, and the preparation checklist that ensures the partner and the engagement manager are aligned before the room fills.

Module 10. Standardising the Methodology Across Your Practice

Running this build ad hoc per engagement is expensive and inconsistent. This module covers how to extract the reusable components from the methodology, how to document them as practice assets, and how to onboard managers to the build so the partner's time is spent on the narrative and the relationship, not on reconstructing the scoring architecture from scratch. Covers template governance, version control for the scoring model, and the quality review steps before client delivery.

Module 11. Handling the Scope Conflict Between Regulatory Regimes

NIS2, DORA, and ISO 27001 have overlapping but non-identical scope. When a client is subject to all three, the risk model must resolve those boundaries or the board will surface the conflict in the room. This module covers the three most common scope conflicts, the documentation approach that makes resolution visible to a regulator, and when separate scores are more defensible than a single composite position.

Module 12. Building the Follow-On Engagement from the Deliverable

A well-constructed risk deliverable surfaces the next engagement naturally. The action register identifies work the client needs to do; the partner who owns the methodology is positioned to support it. This module covers how to close the initial engagement in a way that frames the remediation pathway, how to structure the follow-on scope before the board meeting ends, and how to document the client's agreed risk position as the baseline for the next assessment cycle.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Client board keeps returning the risk slide: Modules 1, 7, 9

Scoring model does not span NIS2, DORA, and sector regulator in one view: Modules 2, 3, 4, 5, 11

Senior hours rebuilding the methodology per engagement: Modules 10, 12

Board-facing artefacts not surviving governance review: Modules 6, 7, 8

What you get with this course

12 written modules covering the full cross-regulatory risk quantification methodology
Reusable heat map template calibrated to NIS2, DORA, and ISO 27001 materiality thresholds
Materiality statement structure with sector-variant versions
Action register format sized for board risk committee consumption
Partner narrative preparation checklist
Practice asset documentation template for methodology standardisation
Hand-built implementation playbook delivered alongside course access, tailored to your practice context

What you will have in hand by Day 1, Week 1, Month 1

Course access and implementation playbook provisioned within 24 hours of purchase

Each module is self-paced, designed for 30-45 minutes of focused reading plus template review

Full methodology actionable within two weeks of starting, with templates ready for the next client engagement cycle

Before and after

Before

Each client engagement requires senior hours to rebuild the bridge between the technical assessment and the board-ready risk artefact. The methodology is implicit, inconsistent across managers, and not reusable at scale.

After

A documented, repeatable methodology your practice deploys per engagement. The scoring architecture, the three client artefacts, and the partner narrative are standardised. Senior time shifts from construction to relationship.

What happens if you do not address this

The board keeps returning the risk slide. A competitor practice with a sharper cross-regulatory model closes the follow-on work. The methodology gap stays implicit, continues to cost senior hours per engagement, and does not become a practice asset.

Who it is for

Cyber Security Partners and Directors at professional services firms who lead multi-client regulatory and risk advisory practices. You are accountable for the quality and commercial value of client deliverables, not just the technical correctness of the underlying assessment. You spend real time bridging the gap between your technical team's output and the language a board risk committee accepts.

Who this is NOT for. In-house CISOs managing a single organisation's risk posture. Analysts and managers who are not yet accountable for the client-facing narrative. Anyone looking for sector-specific regulatory compliance implementation rather than the cross-regulatory risk quantification methodology itself.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. 30-45 minutes per module. 12 modules. Designed for a senior professional who reads between client commitments, not in a classroom block.

Why $199 is the right number

General cyber risk frameworks (FAIR, ISO 27005) cover quantification in the abstract but do not address the cross-regulatory mapping problem or the board-narrative layer. Regulatory compliance courses (NIS2, DORA standalone) cover the obligation but not the synthesis methodology. This course covers the methodology a Partner-level practitioner needs to deliver the cross-regulatory risk position to a board client, not the regulatory background reading.

FAQ

Is this relevant if my clients are primarily in one sector, not multi-sector?

Yes. The methodology covers sector-specific materiality calibration as a dedicated module. The cross-regulatory scoring architecture applies whether your client set spans sectors or sits entirely within one. The sector-calibration layer adapts to your practice context.

My team already has a risk model. Why rebuild?

The course is not a replacement for your existing model. It is a methodology for adding the regulatory mapping layer and the board-narrative architecture that most technical models lack. The templates slot in as a layer above your current assessment output.

How is the implementation playbook tailored?

The playbook is hand-built based on the practice context you describe after purchase. It covers the specific regulatory overlay most relevant to your client mix, the team deployment model, and the quality review steps for your practice structure.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.