# Cyber Risk Management & GRC: From Risk to Assurance Course (Self-Paced) Canonical URL: ## Overview This course is a full pass through governance, risk and compliance, written for the practitioner who has to convert technical findings into a defensible risk decision. It runs the entire arc, from defining governance and accountability through assessing risk, analyzing and prioritizing it, choosing a response, recording it in a register, mapping it to controls, validating through assessment, extending it to third parties, and reporting it upward. It also teaches the federal stack and its commercial and international parallels side by side, placing NIST SP 800-30, 800-39 and the IR 8286 series alongside COSO, ISO 31000, ISO/IEC 27005 and the EU Digital Operational Resilience Act, which makes it as useful to commercial and multinational teams as to federal ones. Cyber risk quantification is where the course goes furthest. It covers the FAIR model and then applies a materiality determination using the SEC disclosure criteria in Item 1.05 of Form 8-K and Item 106 of Regulation S-K, taking learners well past the qualitative red, amber and green where most training stops, on the question boards are asking right now. The final module is a workshop in which learners build risk register entries for a fictional organization, decide whether a scenario triggers a disclosure obligation, and defend a risk treatment recommendation. One scope note: third-party material here is enterprise-level oversight and governance, while acquisition-level cyber supply chain risk management is covered separately in its own course. ## What you'll learn - Define governance, risk and compliance, and distinguish cybersecurity risk from enterprise risk - Establish governance structures, risk appetite and risk tolerance, and identify who holds decision authority - Scope and conduct a cyber risk assessment, from threat sources through to documented risk - Prioritize risk by organizational impact and select a defensible response - Distinguish qualitative risk ratings from quantitative risk quantification, and apply the FAIR model - Apply a materiality determination to an incident using the SEC disclosure criteria - Build a cybersecurity risk register structured to NIST IR 8286A, and stage risks for enterprise oversight - Map risks to security controls, and distinguish control implementation from control effectiveness - Assess third-party and supply-chain risk at the enterprise-governance level - Define key risk indicators, set thresholds, and communicate risk to nontechnical stakeholders ## Prerequisites Foundational cybersecurity knowledge. ## Curriculum #### Module 1 - Risk Is the Business: Cyber Risk & GRC Foundations - Defining GRC - Cybersecurity risk versus enterprise risk via COSO and ISO 31000 - Assets, threats, vulnerabilities, likelihood and impact - Emerging and AI-specific risk - Inherent versus residual risk - Risk and control owners #### Module 2 - Set the Rules: Governance, Strategy & Accountability - Policies, standards, procedures and guidelines - Roles and responsibilities - Risk appetite and tolerance - Governance committees and decision authorities - NIST CSF 2.0 Govern including the GV.SC supply-chain category - Federal authorizing officials compared to commercial boards and audit committees #### Module 3 - Find the Risk: Cyber Risk Assessment - Scope and context - Critical assets and business dependencies - Threat sources and threat-event scenarios - Vulnerabilities and predisposing conditions - Likelihood and impact - NIST SP 800-30 compared with ISO/IEC 27005:2022 #### Module 4 - Make the Call: Risk Analysis, Quantification & Response - Interpreting results - Prioritization - Acceptance, avoidance, mitigation, transfer and sharing - Qualitative ratings versus quantification - The FAIR model and FAIR-MAM - Escalation - SEC materiality determination #### Module 5 - From Findings to Action: Risk Registers & Treatment Plans - The risk register per NIST IR 8286A Rev. 1 - Writing risk statements - Causes, events and consequences - Risk owners - Staging risks for enterprise risk management per IR 8286C Rev. 1 - POA&Ms and their basis in OMB Circular A-130 #### Module 6 - Controls Change Risk: Security Controls & Frameworks - Purpose of controls - Administrative, technical and physical - Preventive, detective, corrective and recovery - Selection and tailoring - Common, system-specific and hybrid - Implementation versus effectiveness - The NIST SP 800-53 Rev. 5 Release 5.2.0 families #### Module 7 - Trust but Verify: Compliance, Assessment & Assurance - Risk management versus compliance - Control objectives - Internal versus independent assessment - Objective evidence - Examine, interview and test methods per SP 800-53A - Deficiencies and findings - Compensating controls and exceptions #### Module 8 - Risk Beyond Your Walls: Third-Party & Supply Chain Risk - Enterprise-level third-party oversight distinguished from acquisition-level C-SCRM - Supplier criticality - Supply-chain threats - Security requirements in acquisitions - Flow-down to subcontractors - DORA as a regulator-mandated example #### Module 9 - Risk Never Stands Still: Monitoring, Metrics & Reporting - Continuous monitoring as a risk activity - Control effectiveness per SP 800-137A - Key risk indicators versus key performance indicators - Thresholds and escalation triggers - Dashboards including quantified loss exposure - Board communication per the NACD handbook #### Module 10 - From Analyst to Advisor: GRC Risk Workshop - Applied exercise on a fictional organization covering scenarios, quantification, register entries, control gaps, third-party risk, a materiality call, and a defended treatment recommendation ## Pricing **Tuition:** $1049