Description

This curriculum mirrors the end-to-end risk assessment lifecycle conducted in large-scale IT organizations, comparable to multi-phase advisory engagements that integrate with ITIL, GRC, and security operations workflows across hybrid environments.

Module 1: Defining the Risk Assessment Framework and Scope

Selecting between ISO 27005, NIST SP 800-30, and FAIR as the foundational methodology based on organizational risk appetite and regulatory environment.
Determining the scope boundaries for risk assessment: whether to include third-party SaaS providers, on-prem infrastructure, or hybrid cloud environments.
Establishing criteria for asset criticality classification using business impact analysis (BIA) input from departmental stakeholders.
Deciding whether to assess risks at the system, application, or data level based on compliance requirements and operational complexity.
Defining ownership roles for risk registers and ensuring alignment with existing ITIL processes such as change and incident management.
Negotiating access rights for risk assessment teams to production systems, network diagrams, and configuration databases (CMDB).
Integrating risk assessment scope with enterprise architecture documentation to maintain consistency across technology domains.
Documenting assumptions and constraints that limit the depth or frequency of assessments, such as resource availability or audit timelines.

Module 2: Asset Identification and Valuation

Mapping IT assets to business services using service catalogs to prioritize valuation efforts on mission-critical systems.
Assigning monetary or operational value to data assets based on recovery cost, regulatory fines, or reputational impact.
Resolving discrepancies between CMDB records and actual deployed assets through reconciliation with network scanning tools.
Classifying data types (e.g., PII, financial records, intellectual property) to determine protection requirements and exposure levels.
Establishing refresh cycles for asset inventories to maintain accuracy amid frequent cloud provisioning and decommissioning.
Identifying shadow IT assets through log analysis and user behavior monitoring to include in risk evaluation.
Using dependency mapping to assess cascading impact when a shared service (e.g., Active Directory) is compromised.
Documenting asset ownership and custodianship to ensure accountability in risk treatment planning.

Module 3: Threat Modeling and Threat Intelligence Integration

Selecting STRIDE or PASTA for threat modeling based on development lifecycle maturity and system architecture.
Integrating threat intelligence feeds (e.g., ISAC reports, MITRE ATT&CK) into risk scenarios to reflect current adversary tactics.
Conducting red teaming exercises to validate identified threat scenarios against real-world attack patterns.
Adjusting threat likelihood ratings based on geopolitical events or sector-specific targeting trends.
Mapping internal incidents and near misses to threat categories to improve model accuracy.
Defining thresholds for automated ingestion of threat indicators into SIEM and SOAR platforms.
Collaborating with cybersecurity operations to align threat modeling outputs with detection rule development.
Updating threat models after major architectural changes, such as cloud migration or API exposure.

Module 4: Vulnerability Assessment and Exposure Analysis

Scheduling vulnerability scans to minimize impact on production systems during peak business hours.
Configuring scanning tools to exclude sensitive systems (e.g., medical devices, OT) based on risk tolerance and operational constraints.
Validating scan results through manual verification to reduce false positives in patch prioritization.
Correlating vulnerability data with asset criticality to determine exposure severity beyond CVSS scores.
Managing credentials for authenticated scans across multiple domains and cloud environments securely.
Integrating vulnerability findings into ticketing systems with SLAs for remediation tracking.
Assessing configuration drift in cloud environments using CSPM tools to detect insecure settings.
Establishing rules for exception handling when patches cannot be applied due to vendor support or system stability.

Module 5: Likelihood and Impact Analysis

Calibrating likelihood ratings using historical incident data from internal logs and industry benchmarks.
Quantifying impact in downtime hours, financial loss, or customer records exposed using business continuity plans.
Applying Monte Carlo simulations to model compound risks from interdependent vulnerabilities.
Adjusting impact scores for non-financial consequences such as regulatory penalties or loss of customer trust.
Documenting qualitative judgments with supporting evidence to ensure auditability and repeatability.
Conducting expert elicitation sessions with network, application, and security teams to refine estimates.
Mapping risk scenarios to regulatory requirements (e.g., GDPR, HIPAA) to prioritize high-compliance-impact items.
Using heat maps to visualize risk concentration across departments, systems, or geographic locations.

Module 6: Risk Evaluation and Risk Appetite Alignment

Comparing calculated risk levels against organizational risk appetite thresholds defined by the board or risk committee.
Escalating high-risk items with no feasible mitigation path to executive leadership for acceptance decisions.
Adjusting risk ratings based on existing controls documented in SOC 2 or ISO 27001 audits.
Defining tolerable risk levels for different business units based on operational criticality and innovation pace.
Revising risk appetite statements after M&A activity or entry into new regulatory jurisdictions.
Documenting risk acceptance with signed statements from business owners and legal counsel.
Integrating risk evaluation outcomes into capital planning for security investments.
Monitoring changes in risk posture over time to detect trends requiring strategic intervention.

Module 7: Risk Treatment Planning and Control Selection

Selecting between risk mitigation, transfer, avoidance, or acceptance based on cost-benefit analysis and feasibility.
Mapping identified risks to existing controls in NIST 800-53 or CIS Controls to identify coverage gaps.
Designing compensating controls when technical fixes are delayed or impractical.
Prioritizing treatment actions using a weighted scoring model that includes cost, effort, and residual risk reduction.
Coordinating control implementation with change management processes to avoid service disruption.
Specifying ownership and timelines for each treatment action in the risk register.
Integrating control effectiveness metrics into ongoing monitoring dashboards.
Assessing third-party risk treatment plans for cloud providers and managed service vendors.

Module 8: Integration with IT Operations and Change Management

Embedding risk assessment checkpoints into the change advisory board (CAB) review process for high-risk changes.
Automating risk flagging in change management tools when modifications affect critical systems or data.
Requiring risk assessment updates after major incidents to identify systemic control deficiencies.
Linking incident root cause analysis to risk register entries to improve future assessments.
Coordinating with operations teams to validate control effectiveness during system maintenance windows.
Updating runbooks to include risk-based escalation paths for critical system failures.
Ensuring disaster recovery and backup procedures reflect current asset criticality and threat landscape.
Using operational KPIs (e.g., mean time to patch, change failure rate) as inputs to risk monitoring.

Module 9: Continuous Monitoring and Risk Reporting

Configuring SIEM rules to detect deviations from baseline risk treatment timelines and control performance.
Generating automated risk dashboards for executive review with drill-down capability to underlying data.
Establishing thresholds for risk metric alerts (e.g., unpatched critical systems, expired risk acceptances).
Conducting quarterly risk reassessments to reflect changes in infrastructure, threats, or business priorities.
Integrating GRC platform data with external audit findings to validate control effectiveness.
Reporting residual risk levels to audit and risk committees using standardized templates aligned with COSO.
Archiving risk assessment artifacts to meet document retention policies and support future audits.
Updating risk models based on penetration test results and red team exercise outcomes.

Module 10: Regulatory Compliance and Audit Readiness

Mapping risk assessment outputs to specific regulatory controls in frameworks such as SOX, PCI DSS, or FedRAMP.
Preparing evidence packages for auditors that link identified risks to implemented or accepted controls.
Responding to auditor findings by updating risk scenarios and treatment plans within defined timelines.
Aligning risk assessment frequency with audit cycles to ensure current documentation is available.
Documenting risk acceptance decisions with business justification to satisfy compliance reviewers.
Using compliance gaps identified in audits to refine future risk assessment scope and depth.
Coordinating with legal and compliance teams to interpret new regulations affecting risk posture.
Ensuring risk assessment records are stored in secure, version-controlled repositories with access logging.