Cyber Security Risk Assessment & Management Training

This Cyber Security Risk Assessment and Management course will teach you how to how to conduct a security risk assessment to protect your organisation. You will learn about the laws and regulations that impose strict cyber security requirements on all organisations, and gain the skills to develop a compliance assessment plan and employ a standards-based risk management process while maintaining a satisfactory security posture.

Attendees should have a basic knowledge of business processes and technology concepts. No specialised technical knowledge is assumed.

Cyber Security Risk Assessment & Management Training Delivery Methods

• In-Person

• Online

Cyber Security Risk Assessment & Management Training Information

• In this Cyber Security Risk Assessment & Management training, you will learn how to:

  • Implement standards-based, proven methodologies for assessing and managing the risks to your organisation's information infrastructure.
  • Select and implement security controls that ensure compliance with applicable laws, regulations, policies, and directives.
  • Extend security protection to Industrial Control Systems (ICS) and the cloud.

Cyber Security Risk Assessment & Management Course Outline

Module 1: Introduction to Risk Assessment and Management

• Ensuring compliance with applicable regulatory drivers
• Protecting the organisation from unacceptable losses
• Describing the Risk Management Framework (RMF)
• Applying NIST/ISO risk management processes

Module 2: Characterising System Security Requirements

Defining the system

• Outlining the system security boundary
• Pinpointing system interconnections
• Incorporating the unique characteristics of Industrial Control Systems (ICS) and cloud-based systems

Identifying security risk components

• Estimating the impact of compromises to confidentiality, integrity and availability
• Adopting the appropriate model for categorising system risk

Setting the stage for successful risk management

• Documenting critical risk assessment and management decisions in the System Security Plan (SSP)
• Appointing qualified individuals to risk governance roles

Module 3: Selecting Appropriate Security Controls

Assigning a security control baseline

• Investigating security control families
• Determining the baseline from system security risk

Tailoring the baseline to fit the system

• Examining the structure of security controls, enhancements and parameters
• Binding control overlays to the selected baseline
• Gauging the need for enhanced assurance
• Distinguishing system-specific, compensating and non-applicable controls

Module 4: Reducing Risk Through Effective Control Implementation

Specifying the implementation approach

• Maximising security effectiveness by "building in" security
• Reducing residual risk in legacy systems via "bolt-on" security elements

Applying NIST/ISO controls

• Enhancing system robustness through selection of evaluated and validated components
• Coordinating implementation approaches to administrative, operational and technical controls
• Providing evidence of compliance through supporting artefacts

Module 5: Assessing Compliance Scope and Depth

Developing an assessment plan

• Prioritising depth of control assessment
• Optimising validation through sequencing and consolidation
• Verifying compliance through tests, interviews and examinations

Formulating an authorisation recommendation

• Evaluating overall system security risk
• Mitigating residual risks
• Publishing the Plan of Action and Milestones (POA&M), the risk assessment and recommendation

Module 6: Authorising System Operation

Aligning authority and responsibility

• Quantifying organisational risk tolerance
• Elevating authorisation decisions in high-risk scenarios

Forming a risk-based decision

• Appraising system operational impact
• Weighing residual risk against operational utility
• Issuing Authority to Operate (ATO)

Module 7: Maintaining Continued Compliance

Justifying continuous reauthorisation

• Measuring impact of changes on system security posture
• Executing effective configuration management
• Performing periodic control reassessment

Preserving an acceptable security posture

• Delivering initial and routine follow-up security awareness training
• Collecting on-going security metrics
• Implementing vulnerability management, incident response and business continuity processes