ACRM study plan
ACRM · Give each week a clear focus.
8 weeks · About 7 hours per week
Cyber risk landscape and threat environment
Define cyber risk precisely and distinguish it from adjacent operational, technology, and strategic risks using three workplace examples
Classify threat actor categories (nation-state, organized crime, hacktivist, insider, opportunistic) by capability, motive, and targeting behavior
Trace how cloud adoption, remote work, and connected operational technology have reshaped the attack surface and loss potential
Build a loss-event taxonomy covering data breach, ransomware, business interruption, fraud, and third-party failure
Your checkpoint
A two-page threat-and-loss taxonomy table: 12 loss-event types, each with a plausible actor, a one-line mechanism, and a primary victim impact
Cyber risk landscape and threat environment & Cyber risk identification, assessment, and quantification
Analyze external drivers that change cyber loss frequency and severity, including supply-chain concentration, regulatory pressure, and geopolitical conflict
Identify which frequency and severity data sources exist and assess their quality, coverage, and bias
Explain why cyber loss data is thin, correlated, and censored, and state the consequence for modeling
Draft eight realistic loss scenarios for a mid-sized organization and link each to the taxonomy from week one
Your checkpoint
A 600-word landscape brief mapping eight threats to loss types, affected stakeholders, and available data quality on a three-level scale
Cyber risk identification, assessment, and quantification
Apply qualitative assessment tools (risk register, heat map, structured expert elicitation) and state their limitations
Compute expected annualized loss from frequency and severity inputs with explicit assumptions
Construct scenario-based loss estimates that produce a range and a tail percentile rather than a single point
Compare exposure-based, data-driven, and hybrid quantification approaches and select one for a stated decision context
Your checkpoint
A quantification worksheet for five scenarios showing expected loss, assumed 95th-percentile loss, drivers of uncertainty, and a sensitivity note per scenario
Cyber risk identification, assessment, and quantification & Cyber insurance products, coverage, and policy provisions
Interpret model outputs and translate them into limit, retention, and capital decisions
Compare risk financing options including insurance, self-retention, captives, and parametric transfer
Map first-party and third-party loss categories to the corresponding insurance coverage structure
Justify a retention level by weighing premium savings against tail exposure
Your checkpoint
A one-page decision memo for a fictional firm recommending limits, retention, and coverage structure, with the quantified rationale cited from week three
Cyber insurance products, coverage, and policy provisions
Distinguish named-peril, affirmative, and silent cyber coverage and explain why the distinction drives disputes
Parse key provisions including exclusions, sublimits, waiting periods, retroactive dates, and definitions of loss
Compare claims-made and occurrence triggers and describe how each affects long-tail cyber claims
Describe incident response, dependent business interruption, and contingent third-party coverages and their typical sublimits
Your checkpoint
Annotated comparison table of three notional policy structures scoring 10 provisions on breadth, ambiguity risk, and fit to the week four recommendation
Cyber insurance products, coverage, and policy provisions & Cyber risk mitigation, controls, and organizational resilience
Translate quantified risk into control selection using recognized frameworks (NIST CSF, ISO 27001, CIS Controls)
Prioritize controls by loss reduction per dollar rather than by framework completeness
Design a tabletop exercise that tests a specific coverage gap identified in week five
Evaluate how control maturity affects insurability, pricing, and terms
Your checkpoint
A control investment plan mapping eight controls to the loss scenarios they reduce, with an estimated reduction range and cost tier for each
Cyber risk mitigation, controls, and organizational resilience & Legal, regulatory, and incident response considerations
Design resilience elements: business continuity planning, backup and recovery validation, third-party risk management, and tested incident response playbooks
Sequence the incident response lifecycle from detection through containment, notification, and post-incident review
Summarize notification obligations across major regimes (GDPR, NY DFS, SEC, NAIC model) and note conflicts in timing
Identify contractual levers such as indemnity, insurance requirements, and vendor breach obligations
Your checkpoint
A 90-minute tabletop after-action report documenting decisions, a notification timeline with deadlines, and five prioritized remediation actions
Legal, regulatory, and incident response considerations & Cyber risk landscape and threat environment & Cyber risk identification, assessment, and quantification & Cyber insurance products, coverage, and policy provisions & Cyber risk mitigation, controls, and organizational resilience
Apply breach notification triggers and timing rules to ambiguous fact patterns
Reconcile legal and regulatory obligations with policy notice conditions to avoid prejudicing coverage
Integrate all five domains by working scenario-based practice questions under time pressure
Diagnose residual weak areas and build a targeted final-review list
Your checkpoint
A 100-question timed practice exam scored at or above 80 percent, with an error log tagging each miss to a domain and a root-cause note
Milestones
Week 2: Can explain without notes why cyber loss data is biased and correlated, and name four data sources with their limitations
Week 4: Can defend a retention and limit recommendation in under five minutes using expected loss and a tail percentile
Week 6: Can map any control to the loss scenario it reduces and to the policy provision that responds to it
Week 8: Practice exam at or above 80 percent overall with no single domain below 70 percent