ACRM cheat sheet

Threat actors fall into five working categories - nation-state, organized crime, hacktivist, insider, and opportunistic - distinguished by motivation (espionage, revenue, ideology, grievance), capability, and tolerance for detection.

Ransomware operations typically combine encryption with data exfiltration (double extortion); payment does not guarantee deletion, and leak-site publication is used as leverage against victims and their customers.

Confirmed breaches cluster around three initial access vectors: phishing and social engineering, use of stolen or valid credentials, and exploitation of internet-facing vulnerabilities.

Exploitation of newly disclosed vulnerabilities now compresses to days; prioritization by evidence of active exploitation (CISA KEV catalog, EPSS scores) outperforms ranking by CVSS base score alone.

Supply chain and third-party concentration create correlated loss: a single compromised vendor, software update channel, or cloud provider can generate simultaneous claims across many insureds from one intrusion.

Threat intelligence tiers are tactical (hashes, IPs, domains), operational (specific campaigns and TTPs), and strategic (actor intent, sector targeting); MITRE ATT&CK maps observed TTPs to defensive detection and control coverage.

Cyber accumulation risk arises from shared dependencies - cloud regions, DNS, payment processors, managed service providers - and defeats per-entity underwriting that ignores common-mode failure.

Insider risk spans negligent, compromised, and malicious users; malicious insiders are lowest in frequency but highest in per-event severity because they hold legitimate access and know where data resides.

FAIR decomposes risk through asset, threat community, threat event, vulnerability, and loss event; annualized loss exposure (ALE) = loss event frequency (LEF) × loss magnitude (LM).

LEF = threat event frequency × vulnerability (the probability a threat event becomes a loss); LM = primary loss + secondary loss.

Quantitative analysis uses calibrated estimates expressed as ranges (P10/P50/P90) rather than single points, then aggregates the ranges through Monte Carlo simulation.

A loss exceedance curve plots the probability that annual loss exceeds each given dollar amount; it converts directly into retention, limit, and capital decisions.

Primary loss is the organization's own response, recovery, and productivity cost; secondary loss includes fines, defense costs, judgments, customer notification, and reputational damage.

Qualitative risk matrices are fast but suffer range compression and ambiguous scale definitions; they are appropriate for triage, not for limit-setting or capital allocation.

Scenario-based analysis of a specific loss event usually outperforms asset-based inventory for cyber, because data, access, and dependency concentration - not physical assets - drive the loss.

Data quality is a stated limitation in every estimate: record source, method, recency, and confidence, and run sensitivity testing to show which inputs dominate the result.

First-party cyber cover typically includes data restoration, business interruption and extra expense, cyber extortion, and incident response costs; third-party cover includes network security, privacy, and media liability.

Cyber policies are usually claims-made with a retroactive date; acts occurring before the retroactive date are excluded even when the claim is reported inside the policy period.

Business interruption coverage commonly carries a waiting period of 8 to 24 hours that functions as a time deductible, alongside a period of restoration limitation.

Sublimits cap specific coverages - extortion, social engineering fraud, telephone hacking, regulatory defense - inside the aggregate limit, so headline limits overstate available funds.

The event or aggregation definition determines whether a multi-victim incident (cloud outage, single exploited vulnerability) is treated as one loss or many; wording differs materially by insurer.

War and hostile-act exclusions have been tightened following state-linked attacks; check whether dedicated cyber operations language, not just traditional war wording, applies.

Silent cyber: affirmative policies state cyber coverage explicitly, while non-affirmative property and liability forms increasingly exclude or sublimit cyber loss.

Underwriting inputs include revenue, record count, industry class, MFA coverage, backup strategy, endpoint detection, patch cadence, and prior incident history.

Notice conditions are enforceable: late notice can prejudice coverage, and panel counsel or pre-approved vendor requirements may condition reimbursement of response costs.

NIST CSF 2.0 organizes outcomes into six functions - Govern, Identify, Protect, Detect, Respond, Recover; it is a framework of outcomes, not a prescriptive control checklist.

CIS Critical Security Controls (18) and ISO/IEC 27001 (ISMS with Annex A controls) are the control frameworks most often used to evidence mitigation to insurers and regulators.

MFA is the highest-leverage single control; phishing-resistant factors (FIDO2, passkeys) outperform SMS and push-based methods against adversary-in-the-middle phishing kits.

Backup resilience requires 3-2-1 design plus immutability or offline copies and tested restoration; an untested backup is an assumption, not a control.

Recovery objectives: RTO is maximum tolerable downtime, RPO is maximum tolerable data loss measured in time; both derive from a business impact analysis, not from IT preference.

Patch SLAs tier by severity and exposure; CISA binding operational directive deadlines for KEV entries are 2 weeks for internet-facing systems and 3 weeks for all others.

Zero trust replaces perimeter trust with per-request verification, least privilege, and microsegmentation, limiting lateral movement after a credential compromise.

Exercises: tabletop for decision-making and communications, functional or red-team for technical validation; after-action reports must generate tracked corrective actions with owners.

Resilience metrics include mean time to detect, mean time to respond, restore-test success rate, and the percentage of assets covered by MFA, EDR, and centralized logging.

GDPR: notify the supervisory authority within 72 hours of becoming aware unless the breach is unlikely to result in risk; notify affected individuals without undue delay where risk is high.

US state breach notification laws cover all 50 states plus DC; thresholds, required content, and deadlines differ, and several require parallel notice to attorneys general.

HIPAA Breach Notification Rule: individual notice without unreasonable delay and no later than 60 days from discovery; HHS notice and media notice where 500 or more state residents are affected.

SEC rules require Form 8-K Item 1.05 disclosure within four business days of determining an incident is material, plus annual disclosure of cyber risk governance.

NYDFS 23 NYCRR 500 requires notification within 72 hours of a cybersecurity incident and an annual certification of compliance signed by a senior officer.

CIRCIA (2022) directs CISA rulemaking for covered critical infrastructure entities: 72-hour incident reports and 24-hour ransom payment reports once final rules take effect.

Privilege protection is fragile: direct the forensic investigation through outside counsel, limit document distribution, and keep business and litigation workstreams separate.

Incident response sequence: detect and validate, contain, eradicate, recover, then post-incident review, with evidence preservation and chain of custody maintained throughout.

Notification duties also arise by contract - customer agreements, vendor SLAs, and insurance notice conditions - and may impose shorter deadlines than statute requires.