PRMIA CCRM study plan

Build a one-page map of the cyber risk identification lifecycle, from asset discovery through threat and vulnerability enumeration to risk register entry, and label where assessment begins.

Define in writing the difference between a threat, a vulnerability, an exposure, and a loss event, giving two concrete financial-sector examples of each.

Inventory the standard asset classes a bank or insurer must identify (data, applications, infrastructure, third parties, people, physical sites) and note the typical owner of each.

Draft a glossary of 25 cyber risk terms you cannot yet define from memory and flag which domain each term belongs to.

Classify the main threat actor categories (nation-state, organized crime, insider, hacktivist, opportunistic) by motivation, capability, and typical targeting pattern.

Explain how common attack techniques map to the identification stage, using a recognized taxonomy such as MITRE ATT&CK tactics rather than a list of named incidents.

Identify the regulatory and supervisory sources that force cyber risk identification in financial services and summarize what each requires at a high level.

Trace how a third-party or supply-chain dependency becomes an identified risk in the firm's own register.

Apply a qualitative risk-assessment approach (likelihood x impact matrix) to five identified cyber scenarios and record the reasoning behind each rating.

Distinguish inherent risk from residual risk and show how a single control changes the residual score for one scenario.

Explain how risk appetite and tolerance statements constrain which identified risks must be escalated versus accepted.

Practice writing a risk statement in cause-event-consequence form so it can be scored consistently.

Compare qualitative, semi-quantitative, and quantitative assessment methods and state when each is defensible.

Explain the components of a factor analysis of information risk style model: asset value, threat event frequency, vulnerability, loss magnitude, and how they combine.

Compute a simple annualized loss exposure for one scenario by hand and show the sensitivity of the result to the frequency assumption.

Interpret a loss exceedance curve and explain what a given confidence level means to a non-technical executive.

Map a recognized control framework to the assessment outputs from week 4 and identify which controls reduce likelihood versus impact.

Assess control effectiveness rather than control presence, and describe two ways effectiveness testing can fail to detect a real gap.

Design the structure of a cyber risk report that separates inherent risk, control effectiveness, and residual risk for a board audience.

Identify the data-quality limitations in your own week 4 assessment and state how each would bias the result.

Build a risk treatment plan for your top five scenarios, choosing mitigate, transfer, avoid, or accept and justifying each choice against appetite.

Explain how cyber insurance functions as a transfer mechanism, including what it typically does not cover and why limits and exclusions matter for residual risk.

Describe how key risk indicators are selected and set thresholds so they provide early warning rather than after-the-fact reporting.

Outline the escalation path and decision rights for a risk that breaches tolerance.

Integrate identification, assessment, and management into a single end-to-end narrative for one realistic scenario, from discovery to treatment decision.

Identify the feedback loops: how monitoring results and incident lessons re-enter the risk register and change assessments.

Explain how scenario analysis and stress testing complement the ongoing risk register rather than duplicating it.

Diagnose three common program weaknesses (register bloat, stale assessments, untested controls) and propose a specific fix for each.

Consolidate your glossary and notes into a single review sheet organized by domain, resolving any term still unclear.

Answer timed practice questions across all three domains and log every miss by domain and by underlying concept.

Re-teach the three weakest concepts from memory in writing, without notes, and check against your source material.

Finalize a personal list of formulas, frameworks, and definitions you must be able to recall cold on exam day.