Risk Register and Board Pack: Quantify Cyber Risk

<p>Meridian Payments, a fictional Bengaluru payments start-up, is about to present cyber risk to its board for the first time. The CFO does not want a heat map of red and amber guesses; she wants money: what could each risk cost us in a year, what does each control cost, and what are we accepting.</p><p>In five lessons you learn the language of risk (assets, threats, vulnerabilities, likelihood and impact), score six real-looking scenarios with the company's bands, quantify them with single and annualised loss expectancy, decide mitigate, accept, transfer or avoid with return on security investment, map each risk to ISO 27001 controls, cost the backup control's options over three years in Excel, and write a one-page board paper in Word.</p><p>You work in Bartman's in-browser GRC Workspace (risk register, control library), Excel lab and Word lab. Your scenarios and figures are generated for you, so your answers differ from everyone else's. Part of the Bartman Cybersecurity track (Professional Certificate in Cybersecurity, LSBF).</p>

Tools: Risk management, GRC, ISO 27001, Excel, ALE / ROSI, Board reporting