ACRM study guide
ACRM · Work through your exam, one topic at a time.
The Associate in Cyber Risk Management (ACRM) is an associate-level professional designation centered on how organizations identify, measure, finance, and manage cyber risk. The Institutes lists it within its Risk Management designation family, alongside credentials such as the ARM and the ACRR, and the related course ACRM 401: Effectively Managing Cyber Risk also appears in the catalog as a CPCU elective - a sign that the material is written to be useful well beyond a single credential. The ACRM study guide has 5 sections and about 1,613 words.
01Cyber Risk Landscape and Threat Environment
Cyber risk starts with actors and motives. Nation-state groups pursue espionage, pre-positioning for disruption, and intellectual property theft; organized criminal groups pursue monetization through ransomware, business email compromise, and invoice fraud; hacktivists pursue publicity and disruption; insiders-careless or malicious-bypass perimeter controls entirely.
330 words, about 2 min02Cyber Risk Identification, Assessment, and Quantification
Credible quantification rests on identification: asset and data inventories, business-process and dependency mapping (vendors, cloud providers, OT), data classification, threat modeling, and control gap analysis feeding a risk register. Each entry should name the asset, threat, existing controls, and owner, and distinguish inherent risk from residual risk after controls and transfers.
333 words, about 2 min03Cyber Insurance Products, Coverage, and Policy Provisions
Cyber coverage splits into first party and third party. First party includes incident response (forensics, counsel, notification, credit monitoring), data restoration, business interruption and contingent/dependent business interruption, cyber extortion, and social engineering or funds transfer fraud.
286 words, about 1 min04Cyber Risk Mitigation, Controls, and Organizational Resilience
Anchor programs in recognized frameworks: NIST Cybersecurity Framework (Govern, Identify, Protect, Detect, Respond, Recover), ISO/IEC 27001 for the management system, and the CIS Critical Security Controls for prioritized safeguards. Preventive controls include phishing-resistant MFA, vulnerability and patch management, asset inventory, least privilege and privileged access management, network segmentation, endpoint detection and response, email filtering, and hardened configuration-increasingly organized around zero trust.
303 words, about 2 min05Legal, Regulatory, and Incident Response Considerations
Incident response phases-preparation, detection and analysis, containment, eradication, recovery, and lessons learned-run in parallel with a legal workstream. Early actions: engage breach counsel to direct the forensic firm so work product can be argued as privileged, preserve evidence and chain of custody, stand up a decision log, and assess notification duties.
361 words, about 2 min