Description

This curriculum mirrors the iterative decision-making and cross-functional coordination required in multi-workshop risk governance programs, addressing the same complexities organizations face when aligning cybersecurity risk management with enterprise operations, third-party dependencies, and regulatory audits.

Module 1: Defining the Scope and Boundaries of Cybersecurity Risk Management

Determine whether OT/ICS environments are included in the risk assessment scope, considering asset criticality and monitoring limitations.
Decide whether third-party cloud providers (e.g., AWS, Azure) are assessed directly or through compliance with contractual SLAs and audit reports.
Select organizational units to include in the initial risk program rollout, balancing coverage with resource constraints.
Establish whether supply chain risks are assessed at the vendor level or product/component level.
Define thresholds for what constitutes a "material" cybersecurity risk requiring board-level reporting.
Resolve conflicts between legal privilege claims and the need for full risk disclosure in internal assessments.
Choose whether to integrate physical security incidents into the cybersecurity risk register.
Document exclusions explicitly to prevent misinterpretation during audits or regulatory inquiries.

Module 2: Establishing Governance Structures and Accountability

Assign risk ownership for shared systems (e.g., ERP platforms) across business units with overlapping responsibilities.
Define escalation paths for unresolved risks that remain open beyond remediation deadlines.
Implement a RACI matrix for risk treatment decisions involving IT, security, legal, and business stakeholders.
Decide whether the CISO reports to the board’s risk committee or the full board, based on organizational maturity.
Formalize decision rights between centralized security teams and decentralized business units on risk acceptance.
Integrate cybersecurity risk reporting into existing enterprise risk management (ERM) committee cadence.
Resolve conflicts when business leaders reject security controls citing operational disruption.
Document delegation of risk acceptance authority beyond the CISO to prevent accountability gaps.

Module 3: Risk Identification and Asset Criticality Assessment

Map data flows for PII across hybrid environments to identify unmonitored egress points.
Classify legacy systems (e.g., mainframes) based on business impact rather than technical vulnerability count.
Use business service modeling to prioritize systems supporting revenue-generating operations.
Identify shadow IT applications through DNS and proxy logs, then assess their risk exposure.
Decide whether to include dormant or decommissioned systems in the risk inventory based on residual access rights.
Integrate asset discovery tools (e.g., CMDB, EDR) with risk scoring models to automate criticality ratings.
Address discrepancies between IT asset records and actual deployment locations in multi-site organizations.
Assess risks associated with undocumented integrations between core and auxiliary systems.

Module 4: Threat Modeling and Vulnerability Prioritization

Apply STRIDE or PASTA frameworks to high-impact applications undergoing major upgrades.
Adjust CVSS scores based on exploit availability and internal network segmentation controls.
Decide whether to prioritize patching based on asset criticality or exploit likelihood.
Model insider threat scenarios involving privileged users with legitimate access to sensitive data.
Integrate threat intelligence feeds to update attack scenarios for geographically distributed operations.
Assess risks from zero-day vulnerabilities in widely used open-source libraries (e.g., Log4j).
Balance automated vulnerability scanning frequency against system performance requirements.
Document assumptions in threat models for audit and peer review purposes.

Module 5: Risk Quantification and Financial Exposure Modeling

Apply FAIR methodology to estimate probable financial loss for ransomware scenarios.
Estimate downtime costs for critical systems using historical incident data and business unit input.
Decide whether to include reputational damage in quantitative models using proxy metrics.
Calibrate loss magnitude estimates based on insurance policy deductibles and coverage limits.
Model the financial impact of regulatory fines under GDPR or HIPAA for specific breach scenarios.
Adjust risk exposure calculations based on existing control effectiveness, not just control presence.
Present risk metrics in business terms (e.g., cost per record, downtime cost per hour) to non-technical leaders.
Update loss estimates quarterly based on changes in threat landscape and business operations.

Module 6: Control Selection and Implementation Trade-offs

Choose between network segmentation and EDR deployment for containing lateral movement.
Decide whether to implement MFA for all users or phase it based on role-based access levels.
Balance encryption overhead against data sensitivity for databases containing regulated information.
Select DLP tools based on structured vs. unstructured data handling requirements.
Implement compensating controls for systems that cannot support modern security patches.
Optimize SIEM rule tuning to reduce false positives without increasing detection latency.
Assess whether to outsource SOAR capabilities or build in-house orchestration workflows.
Integrate control effectiveness metrics into risk treatment plans for ongoing validation.

Module 7: Risk Treatment and Remediation Decision-Making

Approve risk acceptance for systems with compensating controls and low exploit likelihood.
Escalate unresolved vulnerabilities in vendor-managed systems to procurement and legal teams.
Document rationale for deferring remediation due to business continuity requirements.
Enforce remediation deadlines through integration with project management and change control systems.
Decide whether to decommission high-risk legacy systems lacking vendor support.
Coordinate risk treatment across departments when shared systems require joint action.
Validate remediation through independent testing rather than self-attestation.
Maintain a backlog of deferred risks with periodic reassessment triggers.

Module 8: Third-Party and Supply Chain Risk Integration

Require third parties to provide evidence of penetration testing results for critical vendors.
Assess software bills of materials (SBOMs) for open-source components in procured applications.
Enforce contractual clauses requiring notification of cybersecurity incidents within 24 hours.
Conduct on-site assessments for vendors with access to core production environments.
Map sub-vendors in cloud service chains to identify unmanaged risk dependencies.
Use automated vendor risk scoring platforms with continuous monitoring capabilities.
Decide whether to block procurement of systems without defined end-of-life support dates.
Integrate third-party findings into the enterprise risk register with ownership assignment.

Module 9: Continuous Monitoring and Risk Reporting

Define KPIs for risk program effectiveness, such as mean time to remediate critical findings.
Automate risk dashboard updates from vulnerability scanners, GRC platforms, and ticketing systems.
Adjust risk scoring dynamically based on active threat indicators (e.g., IOC detection).
Produce tailored risk reports for technical teams versus executive leadership.
Conduct quarterly risk validation exercises to test accuracy of risk ratings.
Integrate cyber risk metrics into business continuity and disaster recovery testing.
Archive historical risk data to support trend analysis and audit requirements.
Respond to external audit findings by updating risk treatment plans within defined timelines.

Module 10: Regulatory Compliance and Audit Alignment

Map NIST CSF controls to GDPR requirements for cross-jurisdictional operations.
Prepare evidence packages for SOC 2 Type II audits using existing risk assessment documentation.
Address conflicting control requirements between PCI DSS and internal security policies.
Document risk exceptions for compliance gaps with planned remediation timelines.
Coordinate with internal audit to align risk assessment cycles with annual audit plans.
Respond to regulatory inquiries using risk register data to demonstrate due diligence.
Update risk treatment plans based on changes in cybersecurity regulations (e.g., SEC disclosure rules).
Retain risk assessment records for statutory retention periods in regulated industries.