Cyber Risk Management
What the domain tests
Cyber Risk Management tests treatment and governance: selecting risk responses, assigning ownership, funding controls, monitoring residual risk, and reporting to the board. The exam emphasizes that management is a continuous cycle, not a project. NIST CSF 2.0's Govern, Protect, Detect, Respond, and Recover functions, plus ISO/IEC 27005 treatment options, provide the vocabulary.
Core rules
- Four treatment options: mitigate (reduce likelihood/impact), transfer (insurance, contracts), avoid (stop the activity), accept (documented within appetite).
- Every treatment needs an owner, due date, budget, expected risk reduction, and residual-risk acceptance. A control without an owner is a wish.
- Use three-lines governance: operations own controls, risk/compliance challenges, internal audit assures.
- Monitor with KRIs that are leading and decision-linked, e.g., "percentage of privileged accounts without phishing-resistant MFA," not vanity counts.
- Third-party and concentration risk need contractual controls, service-level monitoring, and exit plans. Cyber insurance transfers some financial loss but not reputation, regulatory, or operational capability.
Worked example
A firm identifies ransomware risk at a logistics provider with residual expected loss of $1.5m/year against a $1m appetite. Mitigation (immutable backups, segmentation, MFA) costs $400k and cuts expected loss to $600k; insurance costs $250k and covers $5m above a $500k retention. The manager recommends mitigation plus insurance, but retains accountability for the retention and for incident response. The residual estimate and accepted retention are documented and approved by the risk committee.
Traps
Treating insurance as a substitute for controls; accepting risk without a named owner; reporting only control counts; ignoring third-party concentration; setting KRIs with no thresholds or escalation; and failing to revisit treatment after incidents or business change.