Cyber Risk Assessment
What the domain tests
Cyber Risk Assessment tests how you turn identified exposures into comparable risk estimates and decide whether they sit within appetite. Expect questions on qualitative, semi-quantitative, and quantitative methods; control effectiveness; inherent versus residual risk; and scenario analysis. CCRM-style assessment is scenario-based and business-facing, not a compliance checklist.
Core rules
- Choose method by decision use: a heat map may triage, but capital, insurance, and board decisions need calibrated estimates.
- A scenario has a threat event, asset/process, threat community, and loss magnitude. FAIR decomposes risk into event frequency and loss magnitude (primary and secondary losses), often using Monte Carlo simulation.
- Assess inherent risk before controls and residual risk after controls. Do not double-count a control that affects both likelihood and impact without documenting the overlap.
- Ordinal labels (Low/Medium/High) are not numbers: do not add or multiply them as if they were cardinal.
- Compare residual risk with risk appetite/tolerance and record assumptions, data sources, confidence, and review date.
Worked example
Ransomware against a claims platform: estimated frequency is 0.2 events/year (once every five years); loss magnitude ranges from $2m to $12m, with a most likely $5m. A simple expected loss is 0.2 × $5m = $1m/year. If endpoint detection and immutable backups cut frequency by 60% and cap impact at $6m, residual expected loss falls, but the tail still matters: a $12m event is plausible. The manager should compare the residual loss exceedance curve, not just the mean, with the $2m tolerance.
Traps
Multiplying ordinal scores; using one-point estimates; ignoring correlated scenarios and tail risk; counting the same control twice; presenting residual risk without inherent risk; and letting vendor or threat data age without recalibration.