CISRM study plan

Define risk, uncertainty, and opportunity in your own words and distinguish inherent risk from residual risk with two worked examples

Map the governance chain from board risk appetite through risk committee to control owners, naming who approves, who owns, and who monitors each layer

Write three risk appetite statements (one qualitative, one quantitative, one hybrid) and test each against a plausible business scenario

Explain how ISO 31000, COSO ERM, and the three-lines model differ in scope and where they overlap, in a one-page comparison

Compute a qualitative risk score using a 5x5 likelihood-impact matrix for five sample risks and justify each rating

Perform a quantitative analysis using single loss expectancy and annualized loss expectancy for three assets, showing all arithmetic

Compare qualitative, semi-quantitative, and quantitative approaches and state when each is defensible given data quality

Identify at least four common scoring pitfalls (range compression, anchoring, correlated threats, double counting) and describe a mitigation for each

Build a tiered asset inventory covering people, process, technology, data, and facilities, and assign an owner and criticality tier to each entry

Trace three business processes to their supporting assets and record the dependency direction

Apply a risk evaluation rule that compares each score against appetite thresholds and produces accept, treat, transfer, or avoid decisions

Rank a register of ten risks by residual exposure and justify the top three with explicit tie-break criteria

Select control types (preventive, detective, corrective, compensating) for six risks and state the expected risk reduction for each

Classify each selected control as administrative, technical, or physical and note the cost driver

Draft a control rationale that links the control to the specific risk scenario rather than to a framework clause

Identify two cases where accepting the risk is the correct decision and defend them in writing

Define three key risk indicators with thresholds, data source, frequency, and escalation path for each

Design a one-page risk report for an executive audience that leads with decisions needed rather than raw scores

Build a third-party tiering scheme and apply it to five vendor types, specifying due diligence depth per tier

Draft contract clauses covering right to audit, breach notification timelines, and subcontractor flow-down

Map five regulatory obligations relevant to your sector to the specific controls that satisfy them, noting evidence produced

Distinguish legal, regulatory, contractual, and internal policy obligations and describe the consequence type for each

Explain cross-border data transfer constraints and recordation duties for at least two regimes

Outline how a regulator inquiry would be answered: who responds, what evidence is pulled, and within what timeline

Distinguish business continuity, disaster recovery, and incident response by objective, owner, and time horizon

Define recovery time objective and recovery point objective for three critical processes and check them against asset dependencies from Week 3

Walk through an incident response lifecycle for one scenario, naming the decision authority at each phase

Identify two continuity gaps revealed by comparing recovery targets to current capability and propose a closing action for each

Re-derive the governance-to-treatment chain end to end using one integrated scenario and check every handoff for a named owner

Re-score the Week 3 register under current assumptions and explain every score change

Complete a timed 60-question mixed-domain practice set and review every missed item to root cause

List your five weakest concepts and write a corrective note for each