Cyber Risk Management & GRC: From Risk to Assurance

A self-paced pass through governance, risk and compliance, for whoever has to convert a technical finding into a risk decision that survives being questioned. The course covers the arc end to end: defining governance and accountability, assessing and prioritizing risk, picking a response, writing it into a register, mapping it to controls, validating through assessment, extending to third parties, and reporting upward. NIST and commercial frameworks are taught side by side — NIST SP 800-30, 800-39 and the IR 8286 series alongside COSO, ISO 31000, ISO/IEC 27005 and the EU Digital Operational Resilience Act — usable in a multinational or a single-market business alike.

Quantification is where the course goes furthest: the FAIR model, then a materiality determination against the SEC disclosure criteria in Item 1.05 of Form 8-K and Item 106 of Regulation S-K, well past the qualitative red, amber and green where most training stops. A closing workshop has you writing risk register entries for a fictional organization, judging whether a scenario triggers a disclosure obligation, and defending a treatment recommendation. Third-party content here is enterprise-level governance; procurement-level supply chain work lives in its own course, Cybersecurity Supply Chain Risk Management (C-SCRM) (Self-Paced).

What You Will Learn

• Define governance, risk and compliance, and distinguish cybersecurity risk from enterprise risk
• Establish governance structures, risk appetite and risk tolerance, and identify who holds decision authority
• Scope and conduct a cyber risk assessment, from threat sources through to documented risk
• Prioritize risk by organizational impact and select a defensible response
• Distinguish qualitative risk ratings from quantitative risk quantification, and apply the FAIR model
• Apply a materiality determination to an incident using the SEC disclosure criteria
• Build a cybersecurity risk register structured to NIST IR 8286A, and stage risks for enterprise oversight
• Map risks to security controls, and distinguish control implementation from control effectiveness
• Assess third-party and supply-chain risk at the enterprise-governance level
• Define key risk indicators, set thresholds, and communicate risk to nontechnical stakeholders

Course Outline

Module 1

• Risk Is the Business: Cyber Risk & GRC Foundations
• Defining GRC
• Cybersecurity risk versus enterprise risk via COSO and ISO 31000
• Assets, threats, vulnerabilities, likelihood and impact
• Emerging and AI-specific risk
• Inherent versus residual risk
• Risk and control owners

Module 2

• Set the Rules: Governance, Strategy & Accountability
• Policies, standards, procedures and guidelines
• Roles and responsibilities
• Risk appetite and tolerance
• Governance committees and decision authorities
• NIST CSF 2.0 Govern including the GV.SC supply-chain category
• Federal authorizing officials compared to commercial boards and audit committees

Module 3

• Find the Risk: Cyber Risk Assessment
• Scope and context
• Critical assets and business dependencies
• Threat sources and threat-event scenarios
• Vulnerabilities and predisposing conditions
• Likelihood and impact
• NIST SP 800-30 compared with ISO/IEC 27005:2022

Module 4

• Make the Call: Risk Analysis, Quantification & Response
• Interpreting results
• Prioritization
• Acceptance, avoidance, mitigation, transfer and sharing
• Qualitative ratings versus quantification
• The FAIR model and FAIR-MAM
• Escalation
• SEC materiality determination

Module 5

• From Findings to Action: Risk Registers & Treatment Plans
• The risk register per NIST IR 8286A Rev. 1
• Writing risk statements
• Causes, events and consequences
• Risk owners
• Staging risks for enterprise risk management per IR 8286C Rev. 1
• POA&Ms and their basis in OMB Circular A-130

Module 6

• Controls Change Risk: Security Controls & Frameworks
• Purpose of controls
• Administrative, technical and physical
• Preventive, detective, corrective and recovery
• Selection and tailoring
• Common, system-specific and hybrid
• Implementation versus effectiveness
• The NIST SP 800-53 Rev. 5 Release 5.2.0 families

Module 7

• Trust but Verify: Compliance, Assessment & Assurance
• Risk management versus compliance
• Control objectives
• Internal versus independent assessment
• Objective evidence
• Examine, interview and test methods per SP 800-53A
• Deficiencies and findings
• Compensating controls and exceptions

Module 8

• Risk Beyond Your Walls: Third-Party & Supply Chain Risk
• Enterprise-level third-party oversight distinguished from acquisition-level C-SCRM
• Supplier criticality
• Supply-chain threats
• Security requirements in acquisitions
• Flow-down to subcontractors
• DORA as a regulator-mandated example

Module 9

• Risk Never Stands Still: Monitoring, Metrics & Reporting
• Continuous monitoring as a risk activity
• Control effectiveness per SP 800-137A
• Key risk indicators versus key performance indicators
• Thresholds and escalation triggers
• Dashboards including quantified loss exposure
• Board communication per the NACD handbook

Module 10

• From Analyst to Advisor: GRC Risk Workshop
• Applied exercise on a fictional organization covering scenarios, quantification, register entries, control gaps, third-party risk, a materiality call, and a defended treatment recommendation

This course is available for 365 days. You can choose when to start your access period. Once you activate, you will have 365 days to complete it (access the course materials, quizzes, projects and videos). You may request one extension of seven (7) days. Other extension requests will be evaluated on a case-by-case basis. Videos are not downloadable.