Field Note: What a Good Cyber Risk Workshop Should Produce

The test: could the business act on the output tomorrow? Slides, heat maps and a longer risk register are not the product. Ranked scenarios, owners and decisions are.

Where the structure comes from

NIST SP 800-30 treats a risk assessment as four steps: prepare, conduct, communicate and maintain. It builds risk from threat events, vulnerabilities and predisposing conditions, likelihood and impact, and it exists to give decision makers what they need to respond. NIST CSF 2.0 places risk strategy and oversight under Govern, so workshop results need a route to the people who oversee risk. ISO/IEC 27005 and ISO 31000 add guidance on setting risk criteria and running the process. The workshop is where these steps meet the business.

What it should produce

Before the workshop

• Agree the scope (a business unit, a process or the enterprise) and the decision the workshop feeds.

• Draft the impact scale and have an executive sponsor confirm it.

• Collect inputs: recent assessment results, incident history, crown jewel candidates, regulatory obligations and third-party dependencies.

• Seed a set of draft scenarios so people react instead of starting from a blank page.

• Invite business owners with authority to decide, not only security staff.

• Use a facilitator who does not own the answers.

Running it

This shape fits roughly three hours. Adjust the times and keep the order.

1. Frame (15 minutes). State the decision, the scope and the scales.

2. Build scenarios (45 minutes). Start from business processes. Ask what would hurt most, then work back to how it could happen.

3. Rate (60 minutes). Impact first, then likelihood. Record the rationale and a confidence level. Rating impact first helps stop people marking down scenarios they find hard to imagine.

4. Test controls (20 minutes). For the top scenarios, ask what evidence shows each control works.

5. Decide (30 minutes). Settle owners and decisions in the room.

6. Close (10 minutes). Read back the decisions and the open questions.

Common failures

• Heat-map theater. Colors replace reasoning. Require a rationale for every rating.

• The loudest voice sets the score. Collect individual ratings first, then discuss the differences.

• A vulnerability list relabelled as a risk list. A vulnerability is a weakness. Risk needs a threat, an asset and a consequence.

• Security does all the talking. If the business owners stay quiet, the impact ratings are guesses.

• Outputs stay on slides. Nothing changes until the register is updated and owners have the decisions in writing.

Quality checks before you send the output

• Could someone who missed the workshop act on it?

• Does every top risk have a business owner, a decision and a date?

• Would the finance lead recognize the impact figures?

• Are any top risks non-technical, such as process, third-party or people risks? A list of only technical items suggests the room was security-only.

• Is each accepted risk recorded with the person who accepted it?

• Do the ratings agree with what incidents and test results show?

After the workshop

Within a few days, update the risk register, send the decision record to each owner, assign the open questions and take the top risks to the forum that oversees risk. Review progress at the next session and carry unresolved items forward with their reasons.

Next step

Take the output of your last workshop and check it against the nine outputs above. The gaps show what to change in the next one.

Sources

1. NIST, Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments.

2. NIST, The NIST Cybersecurity Framework (CSF) 2.0, Cybersecurity White Paper 29.

3. ISO/IEC 27005, Information security, cybersecurity and privacy protection, guidance on managing information security risks.

4. ISO 31000, Risk management, guidelines.