Roadmaps Security roadmaps Governance, risk, compliance and audit
Identify, assess and treat cyber risk in business terms: risk registers, key risk indicators, FAIR quantification, enterprise and operational risk, and cyber insurance.
Estimated time: 15–27 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Threat, vulnerability, likelihood, impact, inherent versus residual risk. Get the vocabulary right so assessments are comparable.
Use threat catalogues, incident history, assessments and interviews to find risks. The risks you miss are the ones that hurt.
Likelihood and impact scales, matrices and heat maps. Simple and widely used, but learn their limits before you rely on them.
A living list of risks with owners, ratings, treatments and dates. Keep it current and short enough that people actually use it.
Reduce, transfer, accept or avoid. Each needs an owner, a decision and a record. Accepting a risk knowingly is fine; ignoring it is not.
The board sets how much risk the organisation will accept. Translate that into thresholds you can assess against.
ISO 27005, NIST RMF and the risk parts of NIST CSF each structure the process. Pick one and run it consistently.
Factor Analysis of Information Risk breaks risk into frequency and magnitude, estimated as ranges, and produces loss in money. Learn the model.
Good quantification depends on honest ranges and calibrated estimators. Learn to estimate with confidence intervals and to reduce bias.
Metrics that move before a risk materialises, such as patch latency or privileged account growth. Choose a few that are measurable and predictive.
Build concrete loss scenarios, such as ransomware taking down order processing for a week, and analyse them end to end. Scenarios make risk real.
Vendors, projects and changes introduce risk continuously. Plug risk assessment into procurement and change so it is not a once-a-year event.
Cyber risk belongs alongside financial, operational and strategic risk. Learn the enterprise risk process and speak its language.
Insurance transfers some risk but has exclusions, requirements and limits. Understand what it covers and what insurers now demand.
Compare the cost of controls with the risk they reduce. Quantification lets you rank projects by return, not by who shouts loudest.
Many small risks add up, and shared dependencies such as a single cloud provider concentrate them. Analyse the portfolio, not only the items.
Fines, enforcement and litigation are part of cyber loss. Factor regulatory exposure into scenarios and work with legal on it.
Feed vulnerability, asset and incident data into risk analysis automatically, and keep the register live rather than annual.
Work with the board to set appetite, and build the programme that keeps the organisation within it as the business and threats change.
Boards want the top risks, the trend, the decisions needed and the money at stake. One page, numbers, plain words.
A good risk culture means people raise risks early and decisions are recorded. Build it through example, process and no blame for honest reporting.
Cyber risk management decides where security effort goes. It identifies what could go wrong, estimates how likely and how bad, and chooses whether to reduce, transfer, accept or avoid each risk, within an appetite the business has agreed.
The discipline runs from qualitative registers and heat maps to quantified analysis with FAIR, and connects to enterprise risk, insurance and board reporting. It needs numeracy, judgement and the ability to talk about loss in money, not just in severity colours.
Security budgets are finite and attacks are not. Organisations need people who can rank risks credibly, justify spending, and give executives numbers they can compare with other business risks.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact