IT Risk Management

This course covers risk management, the primary process organizations use to determine their capability to identify, manage, and respond to risk and verify their ability to maintain confidentiality, integrity, and availability of their information assets. Participants review common risk assessments and analysis requirements for meeting both regulatory and industry expectations and ways to demonstrate technology risks, and their potential outcomes are embedded in their risk management process.

Why you should take this course

For users who are new to internal auditing, or would like to learn more about it.

Here are the topics we'll cover.

1. Introduction to Risk Management

   • Compliance vs. Security
   • Vulnerability, Threat and Risk -Risk Appetite and Tolerance

2. IT Risk Identification and Risk Universe

   • Cybersecurity Incidents and Breaches
   • Time to Discovery
   • Growth of Cybercrime
   • Cybersecurity Considerations
   • Privacy

3. Risk Scenario Development

   • Financial Risks and Breaches
   • Cost Breakdown
   • Incident Response
   • Cause of Loss and Insurance

4. Risk Analysis

   • Enterprise and IT Risk
   • Cybersecurity Risk Components
   • Risk Management Program Components

5. Risk Evaluation

   • Legal and Regulatory Implications
   • Organizational liabilities
   • US Federal and State Laws, and Regulations
   • International Laws and Issues

6. Business Impact Analysis

   • Risk Governance, Awareness and Communication
   • Risk Policies and Risk Management
   • Process Maturity

7. Risk Response

   • Frameworks and Controls
   • NIST, HIPAA, ISO, COBIT, PCI, OWASP
   • Control Baseline
   • Actions

8. Cost Benefit Analysis and Business Case

   • Risk Assessment Types and Varieties
   • Quantitative and FAIR Risk and Cost Analysis
   • Qualitative, OCTAVE, and NIST Assessments

9. Control Development

   • Gartner Hype Cycle
   • Strategic Implications
   • Scoping, Assumptions and Constraints
   • Controls Selection

10. Risk Monitoring and Reporting

    • Information Requests and Data Collection
    • Vulnerabilities and Penetration Testing
    • Sharing Results
    • Risk Registers
    • Process Maturity
    • Keys to Risk Monitoring
    • Cloud Risks and Third-Party Risk Management