I85PREP
⌘ K
GSTP study materials
GSTP study resources

GSTP: Risk Management and Security Program Design

GSTP · Work through your exam, one topic at a time.

All guide sections

Risk Management and Security Program Design

This domain tests how you identify, assess, treat, and monitor risk, and how you convert that into a program with scope, controls, funding, and a roadmap. Expect the NIST RMF steps, the ISO/IEC 27001:2022 clause 6 risk process and Statement of Applicability, FAIR quantification, business impact analysis, and third-party risk tiering.

Core rules

  • Risk is expressed as likelihood and impact. FAIR quantifies it as Risk = Loss Event Frequency multiplied by Loss Magnitude, using ranges from Monte Carlo simulation rather than one number.
  • NIST RMF (SP 800-37 Rev. 2): Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. ISO 27001:2022 requires a repeatable risk assessment, risk treatment with owners, and a Statement of Applicability justifying every Annex A control (93 controls across organizational, people, physical, and technological themes).
  • Program design starts with scope and a control framework map. CSF 2.0, NIST 800-53, CIS Controls v8.1 (18 controls), and ISO 27001 overlap heavily: map once and test once.
  • A BIA sets RTO, RPO, and criticality tiers; tiering then drives control depth and recovery investment.
  • Third parties are tiered by data access and concentration risk; tier determines due diligence depth, contract clauses, and reassessment cadence.

Worked example

A claims platform faces ransomware. Annualized loss exposure is estimated with FAIR: loss event frequency 0.4 per year (range 0.2 to 0.7) and loss magnitude $2.5M (range $1M to $6M) gives ALE near $1M. Immutable backups plus EDR cost $300k per year and cut frequency to 0.15 and magnitude to $1.5M, yielding ALE near $225k. The reasoning is explicit: state assumptions, show ranges, compare risk reduction to cost, and record residual risk acceptance with the business owner. A heat map alone could not justify the spend or the acceptance.

Traps

Treating inherent risk as residual; registers full of risks with no owner or date; copying Annex A controls without SoA justification; doing the BIA once and never again; applying the same vendor questionnaire to a payroll processor and a font CDN; calling insurance transfer when reputational loss remains.