Description

This curriculum spans the full lifecycle of security risk analysis, comparable in scope to an enterprise-wide risk program integrating governance, technical assessment, and executive reporting across dynamic threat and compliance landscapes.

Module 1: Defining Security Risk Governance Frameworks

Selecting between ISO/IEC 27001, NIST SP 800-30, and CIS Controls based on organizational sector and regulatory obligations.
Establishing a risk governance charter that defines roles for CISO, legal, compliance, and business unit leaders.
Integrating security risk governance with enterprise risk management (ERM) reporting structures and board-level oversight cycles.
Deciding whether to adopt a centralized or decentralized risk assessment model across global business units.
Aligning risk tolerance thresholds with business continuity requirements and insurance policy limits.
Documenting risk ownership assignment for critical assets, ensuring accountability for residual risk acceptance.
Designing escalation protocols for high-impact risks that exceed predefined risk appetite statements.
Implementing version control and audit trails for governance policies to support regulatory examinations.

Module 2: Asset Identification and Criticality Assessment

Conducting cross-functional workshops to identify systems, data, and personnel with critical business function dependencies.
Applying a weighted scoring model to rank assets based on confidentiality, integrity, availability, and business impact.
Resolving conflicts between IT and business units over classification of hybrid cloud workloads.
Updating asset registers in response to M&A activity, including integration of legacy systems with differing classification schemes.
Mapping data flows for high-value assets to identify uncontrolled data exfiltration paths.
Implementing automated discovery tools while managing false positives from shadow IT environments.
Establishing review cycles for re-evaluating asset criticality in response to product lifecycle changes.
Documenting exceptions for assets that cannot be inventoried due to operational constraints (e.g., OT systems).

Module 3: Threat Modeling and Intelligence Integration

Choosing between STRIDE, PASTA, and MITRE ATT&CK frameworks based on application architecture and threat landscape.
Integrating external threat intelligence feeds with internal SIEM and vulnerability data to prioritize threat scenarios.
Conducting red teaming exercises to validate assumptions in threat models for high-risk applications.
Adjusting threat likelihood ratings based on geopolitical events or industry-specific attack trends.
Managing over-reliance on historical incident data when modeling novel attack vectors (e.g., AI supply chain compromises).
Defining thresholds for when threat intelligence triggers formal risk reassessment cycles.
Collaborating with physical security teams to model insider threat scenarios involving combined digital and physical access.
Documenting threat actor capabilities, motivations, and TTPs for use in tabletop exercise design.

Module 4: Vulnerability Assessment and Exposure Analysis

Scheduling vulnerability scans to minimize impact on production systems during peak business hours.
Resolving discrepancies between authenticated and unauthenticated scan results in hybrid environments.
Applying context-aware prioritization (e.g., EPSS scores) to distinguish exploitable vulnerabilities from theoretical risks.
Managing false negatives in containerized environments with ephemeral workloads.
Coordinating with development teams to address vulnerabilities in third-party libraries without disrupting CI/CD pipelines.
Assessing exposure of APIs and microservices not covered by traditional network scanning tools.
Documenting compensating controls for vulnerabilities that cannot be patched due to legacy system dependencies.
Integrating findings from penetration tests into the vulnerability management lifecycle for remediation tracking.

Module 5: Risk Quantification and Prioritization

Selecting between qualitative (e.g., heat maps) and quantitative (e.g., FAIR) models based on data availability and stakeholder needs.
Calibrating probability estimates using historical incident data and industry breach statistics.
Adjusting risk scores for control effectiveness based on audit findings and control testing results.
Resolving disagreements between finance and security teams over monetary impact assumptions.
Calculating annualized loss expectancy (ALE) for critical systems to justify control investments.
Managing cognitive biases in risk scoring during group assessment sessions.
Documenting assumptions and data sources used in risk calculations to support external audit requests.
Updating risk rankings quarterly or after major infrastructure changes, mergers, or regulatory updates.

Module 6: Control Selection and Implementation Strategy

Mapping identified risks to existing controls in the organization’s control framework (e.g., NIST 800-53).
Deciding between preventive, detective, and corrective controls based on risk profile and operational feasibility.
Integrating security controls into system development life cycle (SDLC) without delaying product releases.
Assessing the operational impact of control implementation on user productivity and system performance.
Coordinating with procurement to enforce security requirements in vendor contracts and SLAs.
Designing compensating controls for systems where standard controls cannot be implemented (e.g., medical devices).
Phasing control rollouts based on risk criticality and resource availability across business units.
Documenting control ownership and maintenance responsibilities to ensure sustainability.

Module 7: Risk Treatment and Residual Risk Management

Obtaining formal risk acceptance sign-off from business owners for high-impact, low-probability risks.
Tracking open remediation tasks in a risk register with defined deadlines and responsible parties.
Conducting cost-benefit analysis to determine whether to mitigate, transfer, avoid, or accept specific risks.
Transferring risk via cyber insurance and validating policy coverage aligns with actual exposure.
Monitoring effectiveness of implemented controls through key risk indicators (KRIs) and control metrics.
Reassessing residual risk after control implementation to confirm risk reduction targets are met.
Managing risk acceptance fatigue when recurring risks are repeatedly signed off without resolution.
Escalating unresolved risks to executive leadership when remediation timelines exceed risk tolerance.

Module 8: Third-Party and Supply Chain Risk Integration

Classifying third parties based on data access, system integration, and business criticality.
Conducting on-site assessments or requiring audit reports (e.g., SOC 2) for high-risk vendors.
Mapping vendor systems to internal critical assets to assess cascading failure risks.
Enforcing contractual clauses for incident notification, right-to-audit, and data protection standards.
Monitoring vendor security posture changes through continuous assessment platforms.
Responding to fourth-party risks (e.g., cloud providers used by vendors) with limited visibility.
Integrating third-party findings into enterprise risk dashboards for consolidated reporting.
Managing termination risks by ensuring data portability and exit clauses in vendor agreements.

Module 9: Risk Reporting and Executive Communication

Translating technical risk data into business impact terms for board-level presentations.
Designing risk dashboards that balance comprehensiveness with executive readability.
Aligning risk reporting frequency with board meeting cycles and strategic planning timelines.
Responding to auditor inquiries with documented risk assessment methodologies and evidence trails.
Managing disclosure risks when reporting cyber risks in public filings (e.g., SEC requirements).
Reconciling discrepancies between internal risk scores and external audit findings.
Preparing Q&A briefs for CISOs to address challenging questions on risk exposure and mitigation progress.
Archiving risk reports and supporting documentation to meet retention and discovery requirements.

Module 10: Continuous Risk Monitoring and Adaptive Governance

Implementing automated risk scoring updates based on real-time telemetry from SIEM, EDR, and vulnerability systems.
Adjusting risk thresholds in response to changes in business strategy, such as digital transformation initiatives.
Conducting post-incident reviews to update risk models with new threat and vulnerability data.
Integrating risk indicators into change management processes to assess security impact of infrastructure changes.
Managing alert fatigue by tuning risk monitoring rules to reduce false positives without missing critical signals.
Updating governance policies annually or after regulatory changes (e.g., new data privacy laws).
Conducting benchmarking against peer organizations to evaluate risk posture maturity.
Rotating risk assessment team members to prevent process stagnation and introduce fresh perspectives.