USA: +1(669)289-8683 
Sign in
Project 2:
Risk Assessment
Start Here
Organizations must stay up-to-date on their vulnerabilities and protection measures. Once vulnerabilities have been evaluated, the organization uses this information to develop a risk assessment plan. This plan should consider the perspectives of owners, shareholders, employees, policy makers, suppliers, and customers.
In this project, “Risk Assessment,” use the previous findings from Project 1, “Vulnerability and Threat Assessment Report,” to recommend an action plan for the risk assessment assigned in this project. The final assignment is a five- to seven-page review or summary of the risk assessment. Note that this is not a complete risk management report, but a “what if” report outlining potentials in both attacks and possible responses.
For this particular project, grades are based on the ability to clearly and accurately assess policies, processes, and technologies to identify and assess risk and articulate effective mitigation strategies to achieve the appropriate security needed for the enterprise.
This is the second of four sequential projects. There are 12 steps in this project. Begin below to review the project scenario.
TRANSCRIPT
Risk Assessment
You receive an email from your boss, Maria Sosa.
The email reads: Hello, great job with the vulnerability assessment last month. This will help fulfill our DoD contract requirements.
For our next project, you will use the information from that vulnerability assessment to begin a risk assessment. This will help us understand the cybersecurity risk to our mission, function, image, and reputation.
This formal assessment will be completed in the spring, but I’d like you to start thinking about the process now and prepare an executive summary of your plan by the first of the month.
You should use the information in the vulnerability assessment, including internal and external threats, vulnerability information, likelihoods and impacts, to outline the elements for inclusion in your risk assessment. This is the starting point to establish our long-term risk management strategy.
The final report should focus on two elements. The first element is defining the policies, processes, and technologies used to assess and manage risks across all levels of the organization within budget and other logistical constraints. The second element is identifying software acquisition and installation risk, network access risk, and risks associated with social media.
Please submit the initial report for review. Once we have agreed on the final document, we will communicate the findings to all appropriate stakeholders.
FYI – I will be traveling the rest of this week, but feel free to email me with any questions.
Very Respectfully, Maria
Step 1: Review the Risk Management Framework
As the first step in preparing the risk assessment, review the
risk management implementation
framework and the
risk management technologies
that you might use in your assessment.
In the subsequent sections of this project, you will write a risk assessment summary report that can be used in
addressing cybersecurity threats through risk management
.
When this first step is complete, move to the next step, where you will create a list of vulnerable assets.
Step 2: Document Vulnerable Assets (template attached)
In the opening step, you considered the risk management implementation framework and the risk management technologies you might use. Now, it’s time to list the organization’s vulnerable assets.
In order to conduct
effective information risk management
, the vulnerabilities of the system must be understood and documented prior to starting the assessment, regardless of which of the
risk assessment approaches
is used.
Begin by conducting a thorough review of the recently completed Vulnerability and Threat Assessment report. During the review, pay particular attention to which security risks to information systems that might be relevant and consider varying
types of risk assessment and analysis
.
Using the
Vulnerable Assets Template
, identify and create a list of assets considered vulnerable. This is a simple list, not prioritized, not valued, simply identified, but complete. Pay particular attention to application software in both the acquisition and implementation phases. This list of vulnerable assets will also be used during the next step.
Submit the completed list of vulnerable assets for feedback.
Step 3: Review the Vulnerable Assets List
In the previous step, a list of vulnerable assets was compiled from the Vulnerability and Threat Report in the previous project. Now, incorporate any feedback from the previous step and identify specific cybersecurity threats, including network access risk by devices to those assets.
Again, the Vulnerability and Threat Assessment final report is the starting point to fulfill this step in the Risk Assessment. Compiling a complete list of threats and vulnerabilities will act as a comprehensive review of your vulnerability assessment as well as potentially expand the list, now that you have greater input and a second look at your previous results.
Step 4: Document Internal and External Threat (template attached)
You’ve reviewed the list of vulnerable assets, and in this step, you will document threats. Recall that a threat is any event, action, or factor that has the potential to cause damage to the enterprise. Threats can come from a variety of sources, including people (a hacker stealing employee passwords) and natural events (a power blackout causing data loss).
Use the
Internal and External Threats Template
to add all threats and vulnerabilities—internal and external to the enterprise—and tie them to the itemized assets that will be affected. Note that external threats will include a comprehensive review by device type at network access, both direct and indirect, a view of the social media landscape as a threat.
Submit the itemized list of threats for feedback.
Step 5: Research Relevant Environmental Factors
This step continues to build on the internal and external threats as itemized in the previous step by researching relevant external inputs.
Since cybersecurity is a complex and multifaceted endeavor, an effective analysis of threats includes consideration of the threat landscape inherent within the context in which the enterprise operates.
Researching how the external context and environment contribute to threats and vulnerabilities is critical because no company or industry is an island, particularly as it pertains to cybersecurity. The very nature of cybersecurity is hyperconnectivity—across companies within the same industry and across industries with similar information demands.
Be sure to seek external input into the particular situation, specific threats and vulnerabilities, best practices, regulatory factors, government policy issues, previous industry issues, etc. Conduct thorough research in the industry and related industries about previous actions and activities that could affect your company.
When the research is complete, you will use it in the next step to create a list of external threats and vulnerabilities.
Step 6: Describe External/Environmental Inputs to Threats and Vulnerabilities
Using your research from the previous step, create a list of external industry sources and best practices that might apply. Include one or two sentences for each input, commenting on why you think it would add value to your Risk Assessment.
Submit your list of external inputs of threats and vulnerabilities for feedback.
Step 7: Identify Business Impacts and Probabilities
Remember,
cyber risk management and compliance
is not just about the technology. It is also about the impact people, policies, and processes can have on the financial results of the company. After the previous step, in which you created a list of threats and vulnerabilities, now it’s important to consider the effects on business as part of risk assessment.
Each enterprise must identify and address its own unique threat issues because the most obvious threats are not always the most dangerous ones. Many common threats, such as fire, are already mitigated to a high degree through local building codes and modern infrastructure redundancies. These might not require any further action. However, obscure threats, such as disruptive actions taken by a malicious insider, may be completely unmitigated.
Any risk assessment should include a view of the business impact should an identified threat become a reality. Also consider the likelihood of occurrence for each threat so the list can be prioritized and appropriately managed.
For this step, use the external inputs of threats and vulnerabilities compiled in the previous step to consider the business (monetary) impact of any realized threats and the prioritization of these threats by potential impact to the enterprise. In the next step, you will create a list of the business impacts.
Step 8: List Business Impacts and Probabilities (template attached)
You identified the potential financial impacts should identified threats become realities in the last step. Here, use your findings to complete the
Business Impacts and Probabilities Matrix
, listing each identified threat and the risk, the probability, and a potential mitigation to include all policies, processes, and technologies to be used in formulation of financially and logistically sound mitigation strategy.
After you’ve completed this step, you will document and prioritize risk responses. Submit your Business Impacts and Probabilities Matrix for feedback.
Step 9: Consider Risk Response Strategies
Now that you have developed a comprehensive list of potential risks with probabilities and potential business impact, it is time to consider possible
risk response strategies
for these risks. In the next step, you will document and prioritize risk responses.
Step 10: Document and Prioritize Risk Responses (template attached)
In this step, you will prioritize your selected risk responses from the last step based on several factors:
- The economic impact to the organization should the assessed risk occur.
- The likelihood (probability) of an event that would activate the risk.
- The arrangement of assets ranked by priority based on the highest value of the following formula: (economic impact) X (probability) = risk
Risk Formula
Use the
Prioritized Risks and Response Matrix
template to submit your findings for feedback.
Step 11: Compile Your Work Up to This Point
You’ve prioritized your list of risk responses. It’s time to take a look at everything compiled so far for the Risk Assessment Summary Report. Keep in mind that a full risk management report is an intensive team endeavor that takes considerable time and resources to create. Remember that Maria has not tasked you with generating a full risk management report; rather, she has asked you to write a brief “what if” report outlining potentials in both attacks and possible responses.
In this step, take some time to review, make any updates, and compile your risk findings up to this point in preparation for creating the final report in the next step.
Step 12: Write the Risk Assessment Summary Report (report recommendation attached)
Throughout this project, the necessary information has been assembled to provide your boss Maria with a risk assessment so that she may begin developing a long-term risk management strategy. This final step is compiling that information into a cogent “summary report” for presentation to company executives. This report will summarize the Vulnerability and Threat Assessment with the addition of the Risk Assessment just completed.
It is critical to provide recommendations to help the organization implement effective information risk management practices. Use findings in the previous steps to recommend risk management strategies such as least privilege, separation of duties, mandatory vacation, risk management technologies, and others you have found appropriate.
Remember, the recommendations included in the report should address all aspects of the research—business, economic, and technical reasoning for the conclusions.
Follow these
Final Risk Assessment Summary Report
requirements while writing the final risk assessment summary.
Vulnerable Assets Template
In this step, list all the vulnerable assets for the enterprise.
Note that assets should simply be identified at this stage. Items do not need to be prioritized or assigned values. Pay
particular attention to application software in both the acquisition and implementation phases.
This initial list should be as comprehensive as possible, even if you don’t keep every item in your final working list of
resources to be protected.
Vulnerable Assets
2
Internal and External Threats Template
In this step, you will build on your vulnerable asset list from the first step to identify threats and vulnerabilities—internal
and external to the enterprise, for each asset.
Vulnerable Assets
Threats and Vulnerabilities
Note: You can add more rows to the bottom of the table if needed.
2
Business Impacts and Probabilities Matrix
Paste your findings on vulnerable assets and threats into this table, and add the risk, the probability, and potential
mitigation strategies.
Your mitigation strategies should include all policies, processes, and technologies that can be used.
Asset
Threat
Risk
Probability
Mitigation Strategies
Note: You can add more rows to the bottom of the table if needed.
2
Prioritized Risks and Response Matrix
In this step, you will add a final column to your existing threat/asset table that demonstrates a potential response to a
breach. In addition, add a column showing prioritization of these responses.
Asset
Threat
Risk
Probability
Mitigation
Potential
Prioritization
Strategies
Response
of Responses
Note: You can add more rows to the bottom of the table if needed.
2
4/28/22, 9:54 PM
Final Risk Assessment Summary Report Template
Course Resource
Final Risk Assessment Summary Report
Template
Your CIO, Maria Sosa, has asked you to write a “what if” report outlining risks and
responses.
Final Risk Assessment Summary Report (five- to seven-page report using this template:
Step 13). This report should include the following components:
Title Page
Include:
for whom you are preparing the document, the title, the date prepared,
and your name as the preparer of the document
Executive Summary
Include:
the purpose of the report, intended audience, and an explanation of the
importance of risk assessment
relevant external/environmental factors (from Step 6)
Prioritized Risks and Response Matrix (table from Step 8)
Recommended Risk Management Strategies and Technologies (one- to two-page
narrative, from Step 11)
Include:
a summary of your Prioritized Risks and Response Matrix
the consideration of relevant compliance issues
Risk Management Implementation Recommendations (two- to three-page narrative)
© 2022 University of Maryland Global Campus
https://leocontent.umgc.edu/content/umuc/tgs/cmp/cmp630/2222/course-resource-list/final-risk-assessment-summary-report-template.html?ou=632511
1/2
4/28/22, 9:54 PM
Final Risk Assessment Summary Report Template
All links to external sites were verified at the time of publication. UMGC is not responsible for the validity or integrity
of information located at external sites.
https://leocontent.umgc.edu/content/umuc/tgs/cmp/cmp630/2222/course-resource-list/final-risk-assessment-summary-report-template.html?ou=632511
2/2
