I85PREP
⌘ K
ACRM study materials
ACRM study resources

ACRM: Cyber Risk Identification, Assessment, and Quantification

ACRM · Work through your exam, one topic at a time.

All guide sections

Cyber Risk Identification, Assessment, and Quantification

Identify before you measure

Credible quantification rests on identification: asset and data inventories, business-process and dependency mapping (vendors, cloud providers, OT), data classification, threat modeling, and control gap analysis feeding a risk register. Each entry should name the asset, threat, existing controls, and owner, and distinguish inherent risk from residual risk after controls and transfers.

Qualitative and quantitative methods

Heat maps and risk matrices are fast and useful for triage but ordinal, not additive; colors are not comparable across units or raters. Quantitative approaches include scenario analysis, FAIR-style factor decomposition (threat event frequency, vulnerability, loss magnitude: primary response and replacement costs plus secondary fines, legal, and reputation), Monte Carlo simulation, and loss exceedance curves that expose tail risk beyond the average. Risk appetite and tolerance statements, key risk indicators, and aggregation analysis (common-mode failures such as a single cloud region or one managed service provider) complete the picture.

Traps

  • Using color ratings to allocate capital as if they were dollars.
  • Presenting quantitative output without documented assumptions-false precision invites challenge.
  • Double counting controls or correlated scenarios, and quietly assuming residual risk is zero after buying insurance.
  • Ignoring tail events and concentration risk because the mean looks acceptable.

Worked example

A customer database valued at $4M faces three threat events per year; 20% would become actual loss events. A loss event costs about $600K in response and replacement plus $400K in secondary costs, or $1M. Loss event frequency = 3 × 0.20 = 0.6 per year; annualized loss exposure = 0.6 × $1M = $600K. A $150K control reduces vulnerability to 5%: frequency 0.15, exposure $150K, saving $450K annually. The expected-value case is strong, but confirm the tail and whether the control stays effective under pressure.