Description

This curriculum spans the design and operationalization of risk management practices across governance, assessment, treatment, and monitoring, comparable in scope to a multi-phase advisory engagement supporting enterprise-wide IT risk program development.

Module 1: Defining Risk Governance Frameworks in Enterprise IT

Selecting between ISO/IEC 27005, NIST SP 800-30, and COBIT for risk assessment alignment based on organizational compliance requirements.
Establishing risk appetite statements that reflect board-level tolerance for downtime, data exposure, and recovery time objectives.
Integrating risk governance roles into existing ITIL service management roles without duplicating accountability.
Documenting risk ownership for hybrid cloud assets where responsibilities are shared with third-party providers.
Aligning risk thresholds with business unit KPIs to ensure operational relevance across departments.
Designing escalation paths for high-impact risks that bypass standard change advisory boards during critical incidents.
Mapping regulatory mandates (e.g., GDPR, HIPAA) to specific risk treatment actions within the governance framework.
Conducting stakeholder workshops to validate risk criteria definitions before framework rollout.

Module 2: Asset Criticality and Exposure Assessment

Assigning business impact scores to IT assets based on dependency maps from business process modeling.
Using CMDB data to identify undocumented production systems that lack patch management coverage.
Classifying data repositories by sensitivity and residency to determine encryption and access logging requirements.
Adjusting criticality ratings for systems with high automation dependency, such as CI/CD pipelines.
Reconciling asset inventories across cloud provider consoles, on-prem DCIM tools, and SaaS usage logs.
Identifying single points of failure in network topology that affect multiple critical assets.
Updating exposure ratings after infrastructure changes, such as public API exposure or remote access enablement.
Validating asset ownership records quarterly to prevent orphaned systems from evading risk controls.

Module 3: Threat Modeling for Operational Systems

Applying STRIDE methodology to microservices architectures with dynamic service discovery.
Identifying privilege escalation paths in identity federation setups involving SSO and JIT provisioning.
Modeling insider threat scenarios for database administrators with unrestricted access to PII.
Assessing supply chain risks in container images pulled from public registries.
Documenting attack vectors for legacy systems that cannot support modern endpoint protection.
Updating threat models after network segmentation changes, such as DMZ consolidation.
Simulating lateral movement scenarios in hybrid environments with overlapping IP spaces.
Integrating threat intelligence feeds to adjust model assumptions based on active campaigns.

Module 4: Vulnerability Management Integration

Prioritizing patch deployment based on exploit availability, asset criticality, and change freeze schedules.
Resolving false positives in vulnerability scanner reports before triggering remediation workflows.
Coordinating patching windows with application owners to minimize business disruption.
Managing exceptions for systems where patches introduce functional regressions.
Enforcing configuration baselines through automated tools like Ansible or Puppet to reduce drift.
Tracking unpatchable systems in a risk register with compensating controls documentation.
Integrating vulnerability data into service catalogs for incident response planning.
Validating scanner coverage across ephemeral workloads in Kubernetes clusters.

Module 5: Quantitative and Qualitative Risk Assessment

Selecting between FAIR and qualitative scoring models based on data availability and decision urgency.
Estimating annualized loss expectancy (ALE) for ransomware scenarios using historical incident data.
Assigning likelihood ratings using threat intelligence and internal event logs.
Calibrating risk matrices to avoid over-classification of medium-impact events.
Conducting expert elicitation sessions with network, security, and operations leads to refine estimates.
Adjusting impact scores for cascading failures in interdependent systems.
Documenting assumptions and data sources for auditability of risk ratings.
Updating assessments after major infrastructure changes, such as data center migration.

Module 6: Risk Treatment Planning and Control Selection

Selecting compensating controls for systems where encryption cannot be implemented due to performance constraints.
Justifying risk acceptance decisions with documented cost-benefit analysis for board review.
Designing control effectiveness metrics for firewall rule reviews and access recertifications.
Outsourcing monitoring functions to MSSPs while retaining incident response authority.
Implementing segmentation controls to isolate high-risk legacy applications.
Defining SLAs for control implementation timelines based on risk severity tiers.
Mapping selected controls to NIST 800-53 or CIS benchmarks for compliance reporting.
Coordinating control deployment with change management to avoid configuration conflicts.

Module 7: Third-Party and Supply Chain Risk

Requiring SOC 2 Type II reports from SaaS providers with access to customer data.
Conducting on-site audits for co-location providers managing physical server infrastructure.
Enforcing contractual clauses for breach notification timelines and forensic cooperation.
Assessing software bill of materials (SBOM) for open-source components in custom applications.
Monitoring vendor patch release cycles to evaluate timeliness of vulnerability remediation.
Requiring multi-factor authentication for all vendor remote access sessions.
Mapping data flows between enterprise systems and partner environments for exposure analysis.
Terminating integrations with suppliers that fail to meet minimum security control standards.

Module 8: Incident-Driven Risk Reassessment

Triggering risk reassessment after a phishing incident exposes gaps in user training effectiveness.
Updating threat models following detection of previously unknown lateral movement techniques.
Reclassifying assets as critical after an outage reveals undocumented business dependencies.
Adjusting vulnerability management priorities based on exploit patterns observed in recent breaches.
Revising incident response playbooks to address control failures identified in post-mortems.
Re-evaluating third-party risk ratings after a vendor suffers a public data breach.
Initiating configuration reviews after log analysis reveals unauthorized changes.
Reassessing backup retention policies after ransomware encryption of backup snapshots.

Module 9: Risk Reporting and Executive Communication

Translating technical risk metrics into business impact terms for C-suite presentations.
Designing dashboards that show risk trends without overwhelming executives with raw data.
Aligning risk reporting frequency with board meeting schedules and budget cycles.
Highlighting top risks with clear ownership and treatment status in quarterly summaries.
Using heat maps to visualize risk concentration across business units and geographies.
Documenting risk treatment progress for internal and external audit requests.
Preparing risk scenarios for tabletop exercises involving executive leadership.
Archiving risk decisions to support regulatory inquiries and litigation holds.

Module 10: Continuous Risk Monitoring and Automation

Configuring SIEM correlation rules to detect risk threshold breaches in real time.
Automating asset criticality updates based on changes in service dependency data.
Integrating vulnerability scanner outputs into risk registers for dynamic scoring.
Scheduling recurring access reviews for privileged accounts based on risk tier.
Using APIs to pull cloud security posture management (CSPM) findings into risk dashboards.
Triggering risk reassessment workflows after configuration changes in critical systems.
Deploying automated compliance checks for new workloads before production release.
Establishing feedback loops between incident management and risk database updates.