ACRM case studies
ACRM · Put your knowledge to work in context.
The Associate in Cyber Risk Management (ACRM) is an associate-level professional designation centered on how organizations identify, measure, finance, and manage cyber risk. The Institutes lists it within its Risk Management designation family, alongside credentials such as the ARM and the ACRR, and the related course ACRM 401: Effectively Managing Cyber Risk also appears in the catalog as a CPCU elective - a sign that the material is written to be useful well beyond a single credential. The ACRM case studies are 5 cases and about 3,549 words.
1Ransomware at a Regional Health System: Which Link in the Chain Matters Most
Northbridge Health, a three-hospital system with 6,800 staff and 1.1B in revenue, lost access to its EHR for nine days after an intrusion that began through an unpatched internet-facing VPN concentrator. The attacker moved laterally for 11 days, exfiltrated 62,000 patient records and 4 TB of finance data, then deployed encryption across 1,900 endpoints.
713 words, about 4 min2A Retailer's Cyber Risk Model: Correcting the Annualized Loss Figure
Cobalt Ridge, a 480M-revenue online retailer, earns 61% of revenue between 15 November and 31 December. A consultant's cyber risk model reports annualized loss of 11.8M, computed as the average of the firm's only two recorded incidents over three years: a 2.1M business email compromise and a 21.5M loss from a payment-processor outage that straddled Black Friday.
709 words, about 4 min3A Dependent Outage Claim Under a Two-Layer Cyber Tower
Halcyon Foods ( 900M revenue) buys a 10M cyber tower: a 5M primary layer from Carrier A with a 500,000 self-insured retention, and a 5M excess layer from Carrier B on a following-form basis, subject to a 2M sublimit for dependent business interruption and a 1M sublimit for "system failure" (non-malicious outage). In March a ransomware event at Halcyon's managed logistics provider halted outbound shipments for six days, causing 3.4M of lost gross profit and 600,000 of extra expense; Halcyon's own network was untouched apart from one infected laptop.
699 words, about 3 min4Allocating a Fixed Security Budget Under a Regulatory Deadline
Merganser Insurance Group, a regional P&C carrier with 1,400 employees, has 1.2M of discretionary security funding for the coming fiscal year. An external assessment found: MFA on 62% of accounts with administrative accounts excluded; EDR on 71% of endpoints with servers excluded; immutable backups restored in only 2 of the last 8 quarterly tests; no incident response plan exercise since 2022; an 11% phishing simulation click rate; no segmentation between the claims platform and corporate IT.
686 words, about 3 min5Notification, Privilege and Ransom Decisions on a 72-Hour Clock
Verdigris Analytics, a publicly traded US SaaS provider, serves 400,000 US customers and holds data on 2,400 EU data subjects; one customer is a German hospital. On 3 March engineers detect anomalous access to a production storage bucket.
742 words, about 4 min