Description

This curriculum spans the full lifecycle of ISO 27001 risk assessment with the granularity of a multi-workshop advisory engagement, covering asset valuation, threat modeling, risk treatment, and audit alignment as practiced in mature information security programs.

Module 1: Establishing the Risk Assessment Framework

Selecting between qualitative, quantitative, and semi-quantitative risk assessment methods based on organizational data sensitivity and regulatory exposure.
Defining risk criteria including risk appetite, risk tolerance, and impact thresholds in alignment with executive leadership and board expectations.
Integrating the risk assessment framework with existing enterprise risk management (ERM) processes to avoid siloed operations.
Determining the scope of the ISMS to include or exclude specific business units, systems, or geographies based on operational criticality.
Documenting assumptions made during framework design, such as threat actor capability or asset valuation models, for audit traceability.
Assigning ownership of risk assessment roles (risk owners, assessors, approvers) within business and IT units to ensure accountability.
Establishing review cycles for the framework to adapt to changes in business strategy, technology, or threat landscape.
Aligning risk terminology with ISO 27000 definitions to ensure consistency in reporting and interpretation across departments.

Module 2: Asset Identification and Valuation

Conducting cross-functional workshops with business process owners to identify information assets tied to critical operations.
Assigning valuation scores based on confidentiality, integrity, and availability (CIA) using weighted scoring models.
Mapping digital and physical assets to specific business functions to prioritize protection efforts.
Deciding whether to include third-party managed assets in the inventory based on contractual control obligations.
Handling intangible assets such as intellectual property or customer trust using proxy valuation techniques.
Resolving conflicts between IT and business units over asset ownership and classification.
Using automated discovery tools to supplement manual asset registers while validating accuracy and coverage.
Establishing procedures for asset retirement and secure disposal within the valuation lifecycle.

Module 3: Threat and Vulnerability Analysis

Customizing threat libraries (e.g., ENISA, MITRE ATT&CK) to reflect industry-specific attack patterns.
Validating vulnerability data from scanning tools against actual exploitability in the production environment.
Assessing insider threat likelihood based on access levels, turnover rates, and monitoring capabilities.
Integrating threat intelligence feeds into the risk assessment process with defined update frequencies.
Deciding whether to include emerging threats with low probability but high impact in the assessment scope.
Documenting assumptions about threat actor motivation and capability when empirical data is limited.
Correlating identified vulnerabilities with existing security controls to avoid double-counting risk.
Managing discrepancies between vendor-reported CVSS scores and organizational context-specific severity.

Module 4: Risk Scenario Development

Constructing realistic risk scenarios by combining specific assets, threats, and vulnerabilities observed in the environment.
Using attack path modeling to demonstrate how multiple vulnerabilities could be chained in a single breach.
Deciding whether to model cascading failures across interdependent systems or treat risks in isolation.
Engaging technical teams to validate scenario plausibility based on network architecture and configurations.
Documenting scenario assumptions such as patching delays or phishing success rates for future review.
Excluding low-likelihood scenarios that fall below the organization’s risk threshold to maintain focus.
Standardizing scenario descriptions to support consistent analysis and comparison across business units.
Updating scenarios in response to changes in infrastructure, such as cloud migration or M&A activity.

Module 5: Risk Likelihood and Impact Assessment

Calibrating likelihood scales using historical incident data, industry benchmarks, or expert judgment.
Adjusting impact scores based on regulatory fines, operational downtime, and reputational damage.
Resolving disagreements between assessors on likelihood ratings through facilitated consensus sessions.
Applying contextual adjustments to generic impact tables based on organizational size and market position.
Using heat maps to visualize risk levels while avoiding overreliance on color-based decision-making.
Documenting justifications for high-risk ratings to support treatment planning and audit requirements.
Reassessing likelihood and impact when new controls are implemented or business processes change.
Addressing subjectivity in scoring by conducting inter-rater reliability checks across assessors.

Module 6: Risk Evaluation and Prioritization

Ranking risks using a consistent methodology such as risk score (likelihood × impact) with documented thresholds.
Applying business context filters to elevate risks affecting strategic initiatives or customer-facing services.
Presenting risk rankings to senior management using executive summaries that highlight business implications.
Deciding whether to accept, escalate, or mitigate risks that fall within defined tolerance levels.
Handling risks with high uncertainty by placing them under watch rather than immediate treatment.
Aligning risk prioritization with budget cycles and resource availability for realistic planning.
Reconciling conflicting risk priorities between departments through governance committee decisions.
Updating the risk register following evaluation to reflect current status and ownership.

Module 7: Risk Treatment Planning

Selecting appropriate treatment options (avoid, transfer, mitigate, accept) based on cost-benefit analysis.
Mapping selected controls from ISO 27001 Annex A to specific risk treatment actions with justification.
Developing implementation timelines for controls considering technical dependencies and resource constraints.
Assigning control ownership to individuals with authority and accountability for execution.
Documenting exceptions for risks where treatment is deferred due to technical or business limitations.
Integrating risk treatment plans with project management offices (PMO) for tracking and delivery.
Coordinating with procurement to ensure third-party contracts reflect required security controls.
Establishing interim compensating controls for high-risk items during long-term remediation.

Module 8: Integration with Statement of Applicability (SoA)

Justifying inclusion or exclusion of each Annex A control in the SoA based on risk treatment decisions.
Documenting rationale for omitting controls deemed not applicable, including risk assessment references.
Ensuring SoA entries align with control implementation status and audit evidence availability.
Updating the SoA dynamically as new risks emerge or controls are modified.
Resolving auditor findings related to SoA completeness or justification quality.
Linking SoA controls to specific risk scenarios to demonstrate traceability.
Coordinating SoA reviews with internal audit and compliance teams prior to certification audits.
Using the SoA as a living document rather than a one-time compliance artifact.

Module 9: Monitoring, Review, and Continuous Improvement

Defining key risk indicators (KRIs) to track changes in risk levels over time.
Scheduling periodic risk assessment reviews triggered by events such as breaches, audits, or system changes.
Updating risk assessments following significant changes in infrastructure, such as cloud adoption or decommissioning.
Integrating risk assessment outputs into management review meetings with documented decision records.
Using internal audit findings to validate the effectiveness of the risk assessment process.
Conducting gap analyses between current and target risk assessment maturity levels.
Adjusting risk criteria and methodologies based on lessons learned from incident response activities.
Ensuring risk assessment documentation meets evidence requirements for ISO 27001 surveillance audits.