Measuring and Managing Top Cyber Risks

Course details

Finding your organization’s top cyber risks isn’t easy, especially because cyber has become a full-fledged business risk—sometimes eclipsing risks to sales, order fulfillment, and accounts receivable. In this course, the second in a two-part series, Kip Boyle explains how to pinpoint these threats and illustrate the business value of your cybersecurity program’s work to senior decision-makers.

Discover how to identify risks in a way that strengthens your cybersecurity culture, mitigate cyber risks while creating lots of business value, and report your progress to executives, auditors, and other stakeholders. To learn more about how to build a program that supports this work, check out the first course in this series, Building and Managing a Cybersecurity Program.

Concepts

0. Introduction

01 - Protect against cyberattacks
02 - What you should know
03 - Cybersecurity overview

1. Measure Cyber Risks

04 - Plan to measure cyber risks
05 - Data-driven cyber risk management
06 - Understand the 0 10 scale
07 - Set target scores for each control
08 - Decide where to measure information risk
09 - Create a score key for experts
10 - Prepare to collect scores from experts
11 - Score collection workflow
12 - Collect scores from your systems
13 - Challenge - Discover themes
14 - Solution - Discover themes

2. Understand Cyber Risks

15 - The questions that drive you
16 - Determine resilience
17 - Determine the top five risks
18 - Understand the leadership landscape
19 - Challenge - Evaluate std.dev
20 - Solution - Evaluate std.dev

3. Mitigating Cyber Risks

21 - Generate ideas to manage top risks
22 - Estimate costs
23 - Estimate benefits
24 - Prepare proposals
25 - Challenge - Prioritize implementations
26 - Solution - Prioritize implementations

4. Report Progress

27 - Communicate with executives
28 - Communicate with stakeholders
29 - Communicate with auditors

5. Use a Workflow to Organize Work

30 - Determine measurement frequency
31 - Build on baseline measurements
32 - Construct an annual program of work

Conclusion

33 - Next steps with top cyber risks