Enterprise risk management and cyber risk
With ISO 31000 and COSO ERM you bring cyber risk into the same language as the organisation's other risks and build an integrated programme with a risk appetite statement, risk indicators, scenario analysis and board reporting.
Level 401 · 15 lessons · 12 practice labs
Lessons
Frameworks
- ISO 31000 principles and process
- The components of COSO ERM
- Bringing cyber risk into the enterprise register
- Quick task: an enterprise risk taxonomy
Appetite and indicators
- Writing a risk appetite statement
- Tolerances and limits
- Designing key risk indicators
- Quick task: an appetite statement and five KRIs
Scenarios and connections
- Scenario analysis and stress testing
- Interconnected risks: supply, continuity, reputation
- Emerging risks
- Quick task: a multi-dimensional cyber stress scenario
Oversight
- Risk committee and board reporting
- Risk culture and assurance
- Capstone: an enterprise risk profile that includes cyber
Practice labs
- Order the ISO 31000 process: Place ten activities in the ISO 31000 process steps and the COSO components.
- Build an enterprise risk taxonomy: Prepare a two-level taxonomy under strategic, operational, financial and compliance headings that shows where cyber sits.
- Bring cyber risk into the enterprise register: Roll twenty technical cyber risks up into five enterprise risks rescored on the enterprise scales and write the basis.
- Make the appetite statement measurable: Turn eight general appetite phrases into statements with a measurable limit.
- An appetite statement and five KRIs: Write a cyber risk appetite statement for Demirsu Enerji and five key risk indicators with defined thresholds.
- Report tolerance breaches: In six months of indicator data, find tolerance and limit breaches and write the escalation level and proposed action.
- Draw the links between risks: Tabulate how ten risks trigger one another and find the three most connected.
- A multi-dimensional cyber stress scenario: Write a scenario that tells the operational, financial, reputational and compliance effects of a supplier outage along a timeline.
- Scan for emerging risks: From prepared trend summaries, select three emerging risks for the organisation, assess proximity and impact and propose a watch indicator.
- Find what the board report lacks: Check a risk report for appetite comparison, trend, ownership and a decision request.
- Prepare the risk committee report: From the enterprise register, prepare a two-page report with the top five risks, indicator status and treatment progress.
- An enterprise risk profile that includes cyber: Combine the taxonomy, appetite, top risks and sources of assurance for Lodoskaya Denizcilik in one profile.
About this course
With ISO 31000 and COSO ERM you bring cyber risk into the same language as the organisation's other risks and build an integrated programme with a risk appetite statement, risk indicators, scenario analysis and board reporting.
What you will learn
- Frameworks
- Appetite and indicators
- Scenarios and connections
- Oversight
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.