Cyber Risk Assessment

Cyber Risk Assessment

Required Inputs

• Organization: Company name, industry, size (employees, revenue), and technology footprint.
• Scope: Enterprise-wide or specific business unit / system / application.
• Framework Preference: NIST CSF 2.0, ISO 27001, CIS Controls v8, or hybrid.
• Current Security Posture: Existing security program documentation, prior assessments, audit results.
• Regulatory Requirements: Applicable cybersecurity regulations (SOC 2, GDPR, HIPAA, PCI-DSS, CMMC, etc.).
• Known Incidents: Past security incidents, breaches, or near-misses.
• Technology Stack: Key platforms, cloud providers, network architecture overview.
• Budget Context: Current cybersecurity spend and investment capacity.

Execution Steps

1. Framework Selection Guidance

Select the appropriate framework based on organizational context.

Framework Comparison Matrix

Recommended Selection Logic

IF regulatory requirement mandates specific framework --> Use that framework
ELIF organization needs certification --> ISO 27001
ELIF organization is starting from scratch --> CIS Controls v8 (begin with IG1)
ELIF organization needs comprehensive program assessment --> NIST CSF 2.0
ELIF defense contractor or US government supply chain --> NIST CSF 2.0 + CMMC
ELSE --> NIST CSF 2.0 as primary, map to ISO 27001/CIS as needed

2. NIST CSF 2.0 Maturity Assessment

Assess current maturity across all 6 functions, 22 categories.

Maturity Tier Definitions

NIST CSF 2.0 Assessment Matrix

Overall Maturity Score

Function Score = Average of Category Tiers within Function
Overall Score = Weighted Average of Function Scores

Recommended Weights:
  Govern: 15%   Identify: 15%   Protect: 25%
  Detect: 20%   Respond: 15%   Recover: 10%

3. Threat Landscape Analysis

Threat Actor Profiling

Attack Vector Mapping

4. Vulnerability Assessment Methodology

Assessment Layers

Vulnerability Severity Classification (CVSS-Aligned)

5. Crown Jewel Analysis

Identify and classify the organization's most critical digital assets.

Asset Classification Matrix

Crown Jewel Prioritization

Crown Jewel Score = (Confidentiality Impact x 0.4) + (Integrity Impact x 0.3) + (Availability Impact x 0.3)

Scoring: Catastrophic = 5, Major = 4, Moderate = 3, Minor = 2, Negligible = 1
Crown Jewels = Assets scoring >= 4.0

6. Control Gap Analysis and Remediation Prioritization

Gap Analysis Matrix

Remediation Priority Score Calculation

Priority Score = Risk Impact (1-5) x Likelihood of Exploitation (1-5) / Implementation Effort (1-5)

Score > 5.0  --> Immediate (Sprint 1)
Score 3.0-5.0 --> Near-term (30-90 days)
Score 1.0-3.0 --> Medium-term (90-180 days)
Score < 1.0  --> Long-term (180-365 days)

Quick Wins Identification (High Impact, Low Effort)

7. Cyber Risk Quantification (FAIR Methodology)

Factor Analysis of Information Risk (FAIR) Framework

Risk ($) = Loss Event Frequency (LEF) x Loss Magnitude (LM)

Where:
  LEF = Threat Event Frequency (TEF) x Vulnerability (Vuln)
  TEF = Contact Frequency (CF) x Probability of Action (PoA)
  LM  = Primary Loss + Secondary Loss

Primary Loss = Productivity Loss + Response Cost + Replacement Cost + Fines/Judgments
Secondary Loss = Reputation Damage x Secondary Loss Event Frequency (SLEF)

FAIR Risk Scenario Template

Loss Exceedance Curve Output

8. Third-Party / Supply Chain Cyber Risk Assessment

Vendor Risk Tiering

Third-Party Assessment Checklist (Critical/High Tier)

9. Incident Response Readiness Evaluation

IR Readiness Scorecard

IR Readiness Score: Sum of all scores / 48 (max) = [X]%

10. Security Architecture Review Checklist

Network Architecture

Identity and Access

Data Protection

Endpoint and Cloud

11. Cybersecurity Investment Prioritization

Risk Reduction per Dollar (RRPD) Framework

RRPD = Annualized Risk Reduction ($) / Total Cost of Ownership (3-year)

Where:
  Annualized Risk Reduction = ALE(before control) - ALE(after control)
  Total Cost = Implementation + Annual Operation x 3 + Training

Higher RRPD = Better investment

Investment Prioritization Matrix

Investment Decision Categories

12. Regulatory Mapping

Cybersecurity Regulation Cross-Reference

Compliance Gap Heat Map

Output Template

## Cybersecurity Risk Assessment: [Organization]

### Assessment Parameters
| Field | Detail |
|---|---|
| Framework(s) | [NIST CSF 2.0 / ISO 27001 / CIS Controls v8] |
| Scope | [Enterprise / specific systems] |
| Assessment Date | [Date] |
| Assessor | [Name/team] |
| Classification | [Confidential] |

### Executive Summary
[Overall cybersecurity posture, maturity score, top 3-5 critical findings,
headline risk quantification, investment recommendation]

### Maturity Assessment Summary
| NIST CSF Function | Current Tier | Target Tier | Gap |
|---|---|---|---|
| Govern | [1-4] | [Target] | [Gap] |
| Identify | [1-4] | [Target] | [Gap] |
| Protect | [1-4] | [Target] | [Gap] |
| Detect | [1-4] | [Target] | [Gap] |
| Respond | [1-4] | [Target] | [Gap] |
| Recover | [1-4] | [Target] | [Gap] |
| **Overall** | [Weighted] | [Target] | [Gap] |

### Threat Landscape
[Threat actor relevance assessment, top attack vectors, industry-specific threats]

### Crown Jewel Analysis
[Critical asset inventory with classification and current protection assessment]

### Control Gap Analysis
[Prioritized gaps with remediation recommendations]

### Cyber Risk Quantification (FAIR)
| Risk Scenario | Annualized Loss Expectancy | 90th Percentile Loss |
|---|---|---|
| [Scenario 1] | [$X] | [$X] |
| [Scenario 2] | [$X] | [$X] |
| **Total Cyber Risk Exposure** | **[$X]** | **[$X]** |

### Third-Party Risk Summary
[Vendor tier distribution, critical vendor assessment status, key findings]

### Investment Roadmap
| Phase | Investment | Cost | Risk Reduction | RRPD |
|---|---|---|---|---|
| Immediate (0-30 days) | [Quick wins] | [$X] | [$X] | [X.X] |
| Near-term (30-90 days) | [High-priority controls] | [$X] | [$X] | [X.X] |
| Medium-term (90-180 days) | [Program maturity] | [$X] | [$X] | [X.X] |
| Long-term (180-365 days) | [Advanced capabilities] | [$X] | [$X] | [X.X] |

### Regulatory Compliance Status
[Compliance gap summary per applicable regulation]

### Appendices
- A: Detailed NIST CSF 2.0 assessment (all 106 subcategories)
- B: Vulnerability scan summary (redacted)
- C: Third-party vendor risk register
- D: FAIR model assumptions and data sources
- E: Regulatory mapping detail

Quality Checks

• Framework selection is justified based on organizational context, not assumed.
• NIST CSF 2.0 assessment covers all 6 functions including Govern (added in CSF 2.0).
• Threat landscape analysis is specific to the organization's industry and profile, not generic.
• Crown jewel analysis identifies specific critical assets with CIA impact ratings.
• Control gap analysis includes both the gap description and a prioritized remediation recommendation.
• FAIR risk quantification uses ranges (low/most likely/high), not single-point estimates.
• Third-party risk assessment tiers vendors by data access and business criticality.
• Incident response readiness evaluation produces a scored assessment, not just a checklist.
• Security architecture review covers network, identity, data, endpoint, and cloud layers.
• Investment prioritization uses Risk Reduction per Dollar (RRPD) to rank spending decisions.
• Regulatory mapping cross-references specific control requirements across all applicable regulations.
• Vulnerability remediation SLAs are defined by CVSS severity with escalation procedures.