Information & Cyber Security: GRC and Risk Management

This course builds on foundational information security governance, risk, and compliance (GRC) concepts to focus specifically on performing risk assessments throughout the business lifecycle. It covers why and how to assess information and cybersecurity risk, how to build business impact assessments (BIAs) using a service-oriented approach, and how to determine the likelihood of compromise based on controls, so that a risk assessment can communicate clear, actionable messages to executives. The material uses a running scenario throughout: Globomantics Airport, which is undertaking a cloud migration program covering three representative systems — a public customer information website, an HR system, and an aviation/luggage screening system — hosted (in whole or in part) by two candidate cloud service providers, AeroStream and NovaNest.

Answering these requires a structured way to understand what can lead to an undesirable disruption event and how likely that is to occur. Risk treatment (what you actually do about an assessed risk) is a related but separate topic.

Threats successfully cause a breach of confidentiality, integrity, or availability by exploiting vulnerabilities. Whether...