Cyber Risk Management & GRC: From Risk to Assurance

This course is a complete pass through governance, risk and compliance, built for the person who has to turn technical findings into a defensible risk decision. It runs the whole arc, from defining governance and accountability through assessing, analyzing and prioritizing risk, choosing a response, recording it in a register, mapping it to controls, validating through assessment, extending it to third parties, and reporting it upward. It teaches the NIST stack alongside its commercial and international parallels, so NIST SP 800-30, 800-39 and the IR 8286 series sit next to COSO, ISO 31000, ISO/IEC 27005 and the EU Digital Operational Resilience Act.

Risk quantification is the headline. The course covers the FAIR model and then applies a materiality determination under the SEC disclosure criteria, which is exactly what boards are asking their security teams about right now, and very little training at any price gets past qualitative red, amber and green. It closes with a workshop in which participants build risk register entries for a fictional organization, decide whether a scenario triggers a disclosure obligation, and defend a risk treatment recommendation. One scope note: third-party material here is enterprise-level oversight and governance, while procurement-level cyber supply chain risk management is covered separately in Cybersecurity Supply Chain Risk Management (C-SCRM).

What You Will Learn

• Define governance, risk and compliance, and distinguish cybersecurity risk from enterprise risk
• Establish governance structures, risk appetite and risk tolerance, and identify who holds decision authority
• Scope and conduct a cyber risk assessment, from threat sources through to documented risk
• Prioritize risk by organizational impact and select a defensible response
• Distinguish qualitative risk ratings from quantitative risk quantification, and apply the FAIR model
• Apply a materiality determination to an incident using the SEC disclosure criteria
• Build a cybersecurity risk register structured to NIST IR 8286A, and stage risks for enterprise oversight
• Map risks to security controls, and distinguish control implementation from control effectiveness
• Assess third-party and supply-chain risk at the enterprise-governance level
• Define key risk indicators, set thresholds, and communicate risk to nontechnical stakeholders

Course Outline

Module 1

• Risk Is the Business: Cyber Risk & GRC Foundations
• Defining GRC
• Cybersecurity risk versus enterprise risk via COSO and ISO 31000
• Assets, threats, vulnerabilities, likelihood and impact
• Emerging and AI-specific risk
• Inherent versus residual risk
• Risk and control owners

Module 2

• Set the Rules: Governance, Strategy & Accountability
• Policies, standards, procedures and guidelines
• Roles and responsibilities
• Risk appetite and tolerance
• Governance committees and decision authorities
• NIST CSF 2.0 Govern including the GV.SC supply-chain category
• Federal authorizing officials compared to commercial boards and audit committees

Module 3

• Find the Risk: Cyber Risk Assessment
• Scope and context
• Critical assets and business dependencies
• Threat sources and threat-event scenarios
• Vulnerabilities and predisposing conditions
• Likelihood and impact
• NIST SP 800-30 compared with ISO/IEC 27005:2022

Module 4

• Make the Call: Risk Analysis, Quantification & Response
• Interpreting results
• Prioritization
• Acceptance, avoidance, mitigation, transfer and sharing
• Qualitative ratings versus quantification
• The FAIR model and FAIR-MAM
• Escalation
• SEC materiality determination

Module 5

• From Findings to Action: Risk Registers & Treatment Plans
• The risk register per NIST IR 8286A Rev. 1
• Writing risk statements
• Causes, events and consequences
• Risk owners
• Staging risks for enterprise risk management per IR 8286C Rev. 1
• POA&Ms and their basis in OMB Circular A-130

Module 6

• Controls Change Risk: Security Controls & Frameworks
• Purpose of controls
• Administrative, technical and physical
• Preventive, detective, corrective and recovery
• Selection and tailoring
• Common, system-specific and hybrid
• Implementation versus effectiveness
• The NIST SP 800-53 Rev. 5 Release 5.2.0 families

Module 7

• Trust but Verify: Compliance, Assessment & Assurance
• Risk management versus compliance
• Control objectives
• Internal versus independent assessment
• Objective evidence
• Examine, interview and test methods per SP 800-53A
• Deficiencies and findings
• Compensating controls and exceptions

Module 8

• Risk Beyond Your Walls: Third-Party & Supply Chain Risk
• Enterprise-level third-party oversight distinguished from acquisition-level C-SCRM
• Supplier criticality
• Supply-chain threats
• Security requirements in acquisitions
• Flow-down to subcontractors
• DORA as a regulator-mandated example

Module 9

• Risk Never Stands Still: Monitoring, Metrics & Reporting
• Continuous monitoring as a risk activity
• Control effectiveness per SP 800-137A
• Key risk indicators versus key performance indicators
• Thresholds and escalation triggers
• Dashboards including quantified loss exposure
• Board communication per the NACD handbook

Module 10

• From Analyst to Advisor: GRC Risk Workshop
• Applied exercise on a fictional organization covering scenarios, quantification, register entries, control gaps, third-party risk, a materiality call, and a defended treatment recommendation