| name | cyber-risk-assessment |
| description | Cybersecurity risk assessment engine using NIST CSF 2.0, ISO 27001, and CIS Controls v8. Produces maturity assessments, threat landscape analyses, control gap remediation plans, and cyber risk quantification using FAIR methodology. USE THIS SKILL when the user mentions cybersecurity posture, cyber risk, threat assessment, NIST CSF, ISO 27001, CIS Controls, vulnerability assessment, crown jewel analysis, FAIR methodology, cyber risk quantification, third-party cyber risk, incident response readiness, security architecture review, or cybersecurity investment prioritization.
|
Cyber Risk Assessment
Required Inputs
- Organization: Company name, industry, size (employees, revenue), and technology footprint.
- Scope: Enterprise-wide or specific business unit / system / application.
- Framework Preference: NIST CSF 2.0, ISO 27001, CIS Controls v8, or hybrid.
- Current Security Posture: Existing security program documentation, prior assessments, audit results.
- Regulatory Requirements: Applicable cybersecurity regulations (SOC 2, GDPR, HIPAA, PCI-DSS, CMMC, etc.).
- Known Incidents: Past security incidents, breaches, or near-misses.
- Technology Stack: Key platforms, cloud providers, network architecture overview.
- Budget Context: Current cybersecurity spend and investment capacity.
Execution Steps
1. Framework Selection Guidance
Select the appropriate framework based on organizational context.
Framework Comparison Matrix
| Criterion | NIST CSF 2.0 | ISO 27001:2022 | CIS Controls v8 |
|---|
| Best For | Comprehensive risk-based program design | Formal ISMS certification | Tactical, prioritized implementation |
| Approach | Outcomes-based, flexible | Requirements-based, prescriptive | Safeguard-based, prioritized |
| Structure | 6 Functions, 22 Categories, 106 Subcategories | 93 controls in 4 themes | 18 Controls, 153 Safeguards in 3 IGs |
| Certification | No formal certification | Yes (accredited certification) | No formal certification |
| Regulatory Mapping | Maps to most US/intl regulations | Recognized globally for compliance | Maps to NIST CSF and ISO 27001 |
| Maturity Model | 4 tiers (Partial to Adaptive) | Binary (conforms / does not conform) | 3 Implementation Groups (IG1-IG3) |
| Effort to Implement | Medium-High | High (requires formal ISMS) | Low-Medium (start with IG1) |
| Ideal Org Size | Mid-large, any industry | Any size seeking certification | Small-mid, or starting a security program |
Recommended Selection Logic
IF regulatory requirement mandates specific framework --> Use that framework
ELIF organization needs certification --> ISO 27001
ELIF organization is starting from scratch --> CIS Controls v8 (begin with IG1)
ELIF organization needs comprehensive program assessment --> NIST CSF 2.0
ELIF defense contractor or US government supply chain --> NIST CSF 2.0 + CMMC
ELSE --> NIST CSF 2.0 as primary, map to ISO 27001/CIS as needed
2. NIST CSF 2.0 Maturity Assessment
Assess current maturity across all 6 functions, 22 categories.
Maturity Tier Definitions
| Tier | Name | Definition |
|---|
| 1 | Partial | Ad hoc, reactive. Risk management not formalized. Limited awareness. |
| 2 | Risk Informed | Risk management practices approved but may not be organization-wide. Some processes defined. |
| 3 | Repeatable | Formal policies and procedures, consistently implemented. Regular updates. Risk-informed decisions. |
| 4 | Adaptive | Organization adapts practices based on lessons learned and predictive indicators. Continuous improvement. |
NIST CSF 2.0 Assessment Matrix
| Function | Category | Category ID | Current Tier | Target Tier | Gap | Priority |
|---|
| GOVERN | Organizational Context | GV.OC | [1-4] | [1-4] | [0-3] | [C/H/M/L] |
| GOVERN | Risk Management Strategy | GV.RM | [1-4] | [1-4] | [0-3] | |
| GOVERN | Roles, Responsibilities, Authorities | GV.RR | [1-4] | [1-4] | [0-3] | |
| GOVERN | Policy | GV.PO | [1-4] | [1-4] | [0-3] | |
| GOVERN | Oversight | GV.OV | [1-4] | [1-4] | [0-3] | |
| GOVERN | Cybersecurity Supply Chain Risk Mgmt | GV.SC | [1-4] | [1-4] | [0-3] | |
| IDENTIFY | Asset Management | ID.AM | [1-4] | [1-4] | [0-3] | |
| IDENTIFY | Risk Assessment | ID.RA | [1-4] | [1-4] | [0-3] | |
| IDENTIFY | Improvement | ID.IM | [1-4] | [1-4] | [0-3] | |
| PROTECT | Identity Management, Auth, Access Control | PR.AA | [1-4] | [1-4] | [0-3] | |
| PROTECT | Awareness and Training | PR.AT | [1-4] | [1-4] | [0-3] | |
| PROTECT | Data Security | PR.DS | [1-4] | [1-4] | [0-3] | |
| PROTECT | Platform Security | PR.PS | [1-4] | [1-4] | [0-3] | |
| PROTECT | Technology Infrastructure Resilience | PR.IR | [1-4] | [1-4] | [0-3] | |
| DETECT | Continuous Monitoring | DE.CM | [1-4] | [1-4] | [0-3] | |
| DETECT | Adverse Event Analysis | DE.AE | [1-4] | [1-4] | [0-3] | |
| RESPOND | Incident Management | RS.MA | [1-4] | [1-4] | [0-3] | |
| RESPOND | Incident Analysis | RS.AN | [1-4] | [1-4] | [0-3] | |
| RESPOND | Incident Response Reporting and Communication | RS.CO | [1-4] | [1-4] | [0-3] | |
| RESPOND | Incident Mitigation | RS.MI | [1-4] | [1-4] | [0-3] | |
| RECOVER | Incident Recovery Plan Execution | RC.RP | [1-4] | [1-4] | [0-3] | |
| RECOVER | Incident Recovery Communication | RC.CO | [1-4] | [1-4] | [0-3] | |
Overall Maturity Score
Function Score = Average of Category Tiers within Function
Overall Score = Weighted Average of Function Scores
Recommended Weights:
Govern: 15% Identify: 15% Protect: 25%
Detect: 20% Respond: 15% Recover: 10%
3. Threat Landscape Analysis
Threat Actor Profiling
| Actor Type | Motivation | Capability | Targeting | Relevance to Organization |
|---|
| Nation-State (APT) | Espionage, disruption, IP theft | Very High | Specific sectors: defense, energy, finance, healthcare, tech | [High/Medium/Low] |
| Organized Crime | Financial gain | High | Opportunistic + targeted (high-value data, ransomware) | [High/Medium/Low] |
| Hacktivists | Ideological, reputational damage | Medium | Visible brands, controversial industries | [High/Medium/Low] |
| Insider Threat | Financial, grievance, negligence | Varies | Direct access to sensitive data and systems | [High/Medium/Low] |
| Competitors | Competitive advantage, IP theft | Medium | Trade secrets, customer data, pricing | [High/Medium/Low] |
| Script Kiddies | Notoriety, curiosity | Low | Opportunistic (unpatched, exposed systems) | [High/Medium/Low] |
Attack Vector Mapping
| Attack Vector | Likelihood | Common Techniques | Primary Targets | Current Defense Maturity |
|---|
| Phishing / Social Engineering | Very High | Spear phishing, BEC, vishing, smishing | Email users, executives, finance | [1-4] |
| Ransomware | High | Encryption, double extortion, RaaS | Endpoints, file servers, backups | [1-4] |
| Supply Chain Compromise | High | Software supply chain, vendor access abuse | Third-party integrations, SaaS | [1-4] |
| Credential Theft / Abuse | High | Credential stuffing, password spray, MFA bypass | Identity systems, VPN, cloud | [1-4] |
| Vulnerability Exploitation | High | Zero-day, N-day, unpatched systems | Public-facing applications, infrastructure | [1-4] |
| Insider Threat | Medium | Data exfiltration, privilege abuse, sabotage | Sensitive data stores, admin systems | [1-4] |
| Cloud Misconfiguration | Medium | Exposed storage, overprivileged IAM, public APIs | Cloud workloads, storage, databases | [1-4] |
| DDoS | Medium | Volumetric, application-layer | Public-facing services, DNS | [1-4] |
| Physical Access | Low | Tailgating, USB drops, device theft | Offices, data centers, laptops | [1-4] |
4. Vulnerability Assessment Methodology
Assessment Layers
| Layer | Method | Frequency | Tools/Approach |
|---|
| Network infrastructure | Automated vulnerability scanning | Monthly (external), Quarterly (internal) | Nessus, Qualys, Rapid7 |
| Web applications | DAST + SAST + manual testing | Per release + quarterly | Burp Suite, OWASP ZAP, Checkmarx |
| Cloud configuration | Cloud security posture management (CSPM) | Continuous | Prisma Cloud, Wiz, AWS Config |
| Endpoint | EDR telemetry + vulnerability scanning | Continuous + monthly | CrowdStrike, SentinelOne, Microsoft Defender |
| Identity and access | Access review + privilege audit | Quarterly | SailPoint, Azure AD access reviews |
| Third-party / SaaS | Vendor security assessment + SaaS posture | At onboarding + annually | SecurityScorecard, BitSight, questionnaires |
Vulnerability Severity Classification (CVSS-Aligned)
| Severity | CVSS Score | Remediation SLA | Escalation if SLA Missed |
|---|
| Critical | 9.0 - 10.0 | 24-72 hours | CISO immediately |
| High | 7.0 - 8.9 | 7-14 days | CISO weekly |
| Medium | 4.0 - 6.9 | 30-60 days | Security team lead |
| Low | 0.1 - 3.9 | 90 days or next patch cycle | Standard reporting |
| Informational | 0.0 | Track only | N/A |
5. Crown Jewel Analysis
Identify and classify the organization's most critical digital assets.
Asset Classification Matrix
| Asset Category | Examples | Confidentiality Impact | Integrity Impact | Availability Impact | Overall Criticality |
|---|
| Customer PII/PHI | Customer database, health records | Catastrophic | Major | Major | Critical |
| Financial data | Banking credentials, financial statements pre-release | Catastrophic | Catastrophic | Major | Critical |
| Intellectual property | Source code, formulas, designs, trade secrets | Catastrophic | Major | Moderate | Critical |
| Authentication systems | Active Directory, SSO, PKI, MFA infrastructure | Major | Catastrophic | Catastrophic | Critical |
| Core business applications | ERP, CRM, manufacturing systems | Moderate | Major | Catastrophic | High |
| Employee PII | HRIS, payroll, benefits data | Major | Moderate | Moderate | High |
| Communication systems | Email, messaging, collaboration platforms | Moderate | Moderate | Major | High |
| Public-facing systems | Website, customer portal, mobile apps | Moderate | Major | Major | High |
| Internal documentation | Policies, procedures, internal wikis | Low | Moderate | Low | Medium |
| Development/test systems | Non-production environments | Low | Low | Low | Low |
Crown Jewel Prioritization
Crown Jewel Score = (Confidentiality Impact x 0.4) + (Integrity Impact x 0.3) + (Availability Impact x 0.3)
Scoring: Catastrophic = 5, Major = 4, Moderate = 3, Minor = 2, Negligible = 1
Crown Jewels = Assets scoring >= 4.0
6. Control Gap Analysis and Remediation Prioritization
Gap Analysis Matrix
| Control Area | Required Control | Current State | Gap Description | Risk If Unaddressed | Remediation Effort | Priority Score |
|---|
| [Area] | [Control description] | [Implemented/Partial/Missing] | [Specific gap] | [Critical/High/Med/Low] | [Low/Med/High] | [Calculated] |
Remediation Priority Score Calculation
Priority Score = Risk Impact (1-5) x Likelihood of Exploitation (1-5) / Implementation Effort (1-5)
Score > 5.0 --> Immediate (Sprint 1)
Score 3.0-5.0 --> Near-term (30-90 days)
Score 1.0-3.0 --> Medium-term (90-180 days)
Score < 1.0 --> Long-term (180-365 days)
Quick Wins Identification (High Impact, Low Effort)
| Quick Win | Effort | Risk Reduction | Typical Cost |
|---|
| Enable MFA on all external-facing accounts | Low | Very High | $2-5/user/month |
| Disable legacy authentication protocols | Low | High | $0 (configuration) |
| Implement email authentication (SPF, DKIM, DMARC) | Low | High | $0-500/year |
| Deploy endpoint detection and response (EDR) | Medium | Very High | $5-15/endpoint/month |
| Implement privileged access management (PAM) | Medium | Very High | $20K-100K+ |
| Enable cloud security posture management (CSPM) | Medium | High | $10K-50K/year |
| Conduct phishing simulation and training | Low | Medium | $3-8/user/year |
| Review and restrict admin accounts | Low | High | $0 (process) |
7. Cyber Risk Quantification (FAIR Methodology)
Factor Analysis of Information Risk (FAIR) Framework
Risk ($) = Loss Event Frequency (LEF) x Loss Magnitude (LM)
Where:
LEF = Threat Event Frequency (TEF) x Vulnerability (Vuln)
TEF = Contact Frequency (CF) x Probability of Action (PoA)
LM = Primary Loss + Secondary Loss
Primary Loss = Productivity Loss + Response Cost + Replacement Cost + Fines/Judgments
Secondary Loss = Reputation Damage x Secondary Loss Event Frequency (SLEF)
FAIR Risk Scenario Template
| FAIR Factor | Low Estimate | Most Likely | High Estimate | Basis for Estimate |
|---|
| Threat Event Frequency (per year) | [#] | [#] | [#] | [Industry data, threat intelligence, historical incidents] |
| Vulnerability (probability of success given attempt) | [0-1] | [0-1] | [0-1] | [Control effectiveness, pentest results, maturity assessment] |
| Loss Event Frequency (per year) | [Calc] | [Calc] | [Calc] | TEF x Vulnerability |
| Primary Loss ($) | [$] | [$] | [$] | [Direct cost estimation] |
| - Productivity Loss | [$] | [$] | [$] | [Hourly revenue x downtime hours] |
| - Response Cost | [$] | [$] | [$] | [IR firm, forensics, legal, overtime] |
| - Replacement Cost | [$] | [$] | [$] | [System rebuild, data restoration] |
| - Fines and Judgments | [$] | [$] | [$] | [Regulatory penalty ranges, litigation estimates] |
| Secondary Loss ($) | [$] | [$] | [$] | [Reputation, customer churn] |
| - Customer Notification Cost | [$] | [$] | [$] | [$5-50/record industry average] |
| - Credit Monitoring | [$] | [$] | [$] | [$10-30/person x affected population] |
| - Customer Churn | [$] | [$] | [$] | [Churn rate increase x customer LTV] |
| - Brand/Reputation | [$] | [$] | [$] | [Revenue impact estimate] |
| Annualized Loss Expectancy | [$] | [$] | [$] | LEF x Total Loss Magnitude |
Loss Exceedance Curve Output
| Probability of Exceeding | Annual Loss Amount |
|---|
| 90% (likely exceeds) | $[amount] |
| 50% (median scenario) | $[amount] |
| 10% (worst case plausible) | $[amount] |
| 5% (tail risk) | $[amount] |
8. Third-Party / Supply Chain Cyber Risk Assessment
Vendor Risk Tiering
| Tier | Criteria | Assessment Rigor | Frequency |
|---|
| Critical | Access to crown jewels, critical business function, > $1M spend, or single-source dependency | Full security assessment + onsite/virtual audit + continuous monitoring | Annual assessment + continuous |
| High | Access to sensitive data, important business function, $100K-$1M spend | Detailed questionnaire (SIG/CAIQ) + evidence review + external scoring | Annual |
| Medium | Limited data access, replaceable function, $10K-$100K spend | Standard questionnaire + external risk rating review | Biennial |
| Low | No data access, commodity service, < $10K spend | External risk rating only | At onboarding |
Third-Party Assessment Checklist (Critical/High Tier)
| Domain | Key Questions | Evidence Required |
|---|
| Governance | Security program, CISO role, board reporting | Security policy, org chart |
| Access Control | SSO, MFA, privileged access, access reviews | Access control policy, PAM evidence |
| Data Protection | Encryption (transit + rest), DLP, classification | Encryption standards, DLP policy |
| Incident Response | IR plan, breach notification SLA, past incidents | IR plan, notification procedures |
| Business Continuity | DR plan, RTO/RPO, testing frequency | DR test results |
| Compliance | SOC 2 Type II, ISO 27001, relevant certifications | Current audit reports, certificates |
| Vulnerability Management | Scanning frequency, patching SLAs, pentest schedule | Scan reports (redacted), pentest summary |
| Subcontractor Management | Fourth-party risk assessment process | Subcontractor policy, list of critical subs |
9. Incident Response Readiness Evaluation
IR Readiness Scorecard
| Capability | Maturity Level (1-4) | Evidence | Gap |
|---|
| IR plan documented and approved | [1-4] | [Plan document, approval date] | [Gap if any] |
| IR team identified with roles and contact info | [1-4] | [Team roster, contact card] | |
| IR playbooks for top threat scenarios | [1-4] | [Playbook documents] | |
| Detection capability (SIEM, EDR, NDR) | [1-4] | [Tool inventory, coverage map] | |
| Forensic capability (in-house or retained) | [1-4] | [Retainer agreement, tool inventory] | |
| Legal/breach counsel pre-retained | [1-4] | [Retainer agreement] | |
| Cyber insurance in force | [1-4] | [Policy summary] | |
| Tabletop exercise conducted (last 12 months) | [1-4] | [Exercise report] | |
| Technical IR drill conducted (last 12 months) | [1-4] | [Drill report] | |
| Communication templates pre-approved | [1-4] | [Template documents] | |
| Regulatory notification procedures documented | [1-4] | [Procedure document per jurisdiction] | |
| Backup and recovery tested | [1-4] | [Recovery test results] | |
IR Readiness Score: Sum of all scores / 48 (max) = [X]%
| Score Range | Readiness Level | Recommendation |
|---|
| 85-100% | Advanced | Maintain and continuously improve |
| 70-84% | Established | Address specific gaps identified |
| 50-69% | Developing | Significant investment needed; prioritize detection and playbooks |
| < 50% | Initial | IR program build required; engage external support |
10. Security Architecture Review Checklist
Network Architecture
| Control | Expected State | Current State | Finding |
|---|
| Network segmentation (microsegmentation for crown jewels) | Implemented | [Status] | [Finding] |
| Zero trust network access (ZTNA) for remote access | Implemented or planned | [Status] | |
| Web application firewall (WAF) on all public apps | Implemented | [Status] | |
| DDoS protection on public-facing services | Implemented | [Status] | |
| DNS security (DNSSEC, DNS filtering) | Implemented | [Status] | |
| East-west traffic monitoring | Implemented | [Status] | |
Identity and Access
| Control | Expected State | Current State | Finding |
|---|
| MFA on all accounts (phishing-resistant preferred) | Enforced | [Status] | [Finding] |
| SSO for all SaaS and enterprise applications | Implemented | [Status] | |
| Privileged access management (PAM) with session recording | Implemented | [Status] | |
| Just-in-time (JIT) access for admin privileges | Implemented | [Status] | |
| Automated access provisioning/deprovisioning | Implemented | [Status] | |
| Service account management and rotation | Implemented | [Status] | |
Data Protection
| Control | Expected State | Current State | Finding |
|---|
| Encryption at rest (AES-256 or equivalent) | All sensitive data | [Status] | [Finding] |
| Encryption in transit (TLS 1.2+ minimum) | All connections | [Status] | |
| Data loss prevention (DLP) | Implemented at key egress points | [Status] | |
| Data classification and labeling | Implemented | [Status] | |
| Backup encryption and immutability | Implemented | [Status] | |
| Key management (HSM or cloud KMS) | Implemented | [Status] | |
Endpoint and Cloud
| Control | Expected State | Current State | Finding |
|---|
| EDR on all endpoints (servers + workstations) | 100% coverage | [Status] | [Finding] |
| Mobile device management (MDM) | All corporate/BYOD devices | [Status] | |
| CSPM for all cloud environments | Implemented | [Status] | |
| Container security (image scanning, runtime protection) | If using containers | [Status] | |
| Infrastructure as code (IaC) security scanning | If using IaC | [Status] | |
| Cloud workload protection platform (CWPP) | If using cloud compute | [Status] | |
11. Cybersecurity Investment Prioritization
Risk Reduction per Dollar (RRPD) Framework
RRPD = Annualized Risk Reduction ($) / Total Cost of Ownership (3-year)
Where:
Annualized Risk Reduction = ALE(before control) - ALE(after control)
Total Cost = Implementation + Annual Operation x 3 + Training
Higher RRPD = Better investment
Investment Prioritization Matrix
| Investment | ALE Before | ALE After | Risk Reduction | 3-Year TCO | RRPD Ratio | Rank |
|---|
| [Security control/tool] | [$] | [$] | [$] | [$] | [X.X] | [#] |
Investment Decision Categories
| RRPD Ratio | Decision | Justification |
|---|
| > 3.0 | Strong invest | Risk reduction far exceeds cost |
| 1.5 - 3.0 | Invest | Positive ROI on risk reduction |
| 1.0 - 1.5 | Consider | Marginal return; evaluate alternatives |
| 0.5 - 1.0 | Defer unless regulatory | Cost exceeds quantified risk reduction |
| < 0.5 | Do not invest | Poor risk-adjusted return; seek alternatives |
12. Regulatory Mapping
Cybersecurity Regulation Cross-Reference
| Control Domain | NIST CSF 2.0 | SOC 2 (TSC) | GDPR | HIPAA | PCI-DSS 4.0 | ISO 27001 |
|---|
| Access Control | PR.AA | CC6.1-6.3 | Art. 32 | 164.312(a)(1) | Req 7-8 | A.9 |
| Data Encryption | PR.DS | CC6.1, CC6.7 | Art. 32 | 164.312(a)(2)(iv) | Req 3-4 | A.10 |
| Logging/Monitoring | DE.CM, DE.AE | CC7.1-7.2 | Art. 32 | 164.312(b) | Req 10 | A.12.4 |
| Incident Response | RS.MA, RS.AN | CC7.3-7.5 | Art. 33-34 | 164.308(a)(6) | Req 12.10 | A.16 |
| Vulnerability Mgmt | ID.RA, PR.PS | CC7.1 | Art. 32 | 164.308(a)(1) | Req 6, 11 | A.12.6 |
| Vendor Management | GV.SC | CC9.2 | Art. 28 | 164.308(b)(1) | Req 12.8 | A.15 |
| Security Training | PR.AT | CC1.4 | Art. 39 | 164.308(a)(5) | Req 12.6 | A.7.2.2 |
| Risk Assessment | ID.RA, GV.RM | CC3.1-3.2 | Art. 35 | 164.308(a)(1)(ii)(A) | Req 12.2 | A.8.2 |
| Business Continuity | PR.IR, RC.RP | A1.1-A1.3 | Art. 32 | 164.308(a)(7) | Req 12.10 | A.17 |
| Data Retention/Disposal | PR.DS | CC6.5 | Art. 5(1)(e), 17 | 164.310(d)(2) | Req 3.1, 9.4 | A.8.3 |
Compliance Gap Heat Map
| Regulation | Current Compliance | Gap Count (Critical) | Gap Count (High) | Gap Count (Medium) | Overall Status |
|---|
| [Regulation] | [%] | [#] | [#] | [#] | [Red/Yellow/Green] |
Output Template
## Cybersecurity Risk Assessment: [Organization]
### Assessment Parameters
| Field | Detail |
|---|---|
| Framework(s) | [NIST CSF 2.0 / ISO 27001 / CIS Controls v8] |
| Scope | [Enterprise / specific systems] |
| Assessment Date | [Date] |
| Assessor | [Name/team] |
| Classification | [Confidential] |
### Executive Summary
[Overall cybersecurity posture, maturity score, top 3-5 critical findings,
headline risk quantification, investment recommendation]
### Maturity Assessment Summary
| NIST CSF Function | Current Tier | Target Tier | Gap |
|---|---|---|---|
| Govern | [1-4] | [Target] | [Gap] |
| Identify | [1-4] | [Target] | [Gap] |
| Protect | [1-4] | [Target] | [Gap] |
| Detect | [1-4] | [Target] | [Gap] |
| Respond | [1-4] | [Target] | [Gap] |
| Recover | [1-4] | [Target] | [Gap] |
| **Overall** | [Weighted] | [Target] | [Gap] |
### Threat Landscape
[Threat actor relevance assessment, top attack vectors, industry-specific threats]
### Crown Jewel Analysis
[Critical asset inventory with classification and current protection assessment]
### Control Gap Analysis
[Prioritized gaps with remediation recommendations]
### Cyber Risk Quantification (FAIR)
| Risk Scenario | Annualized Loss Expectancy | 90th Percentile Loss |
|---|---|---|
| [Scenario 1] | [$X] | [$X] |
| [Scenario 2] | [$X] | [$X] |
| **Total Cyber Risk Exposure** | **[$X]** | **[$X]** |
### Third-Party Risk Summary
[Vendor tier distribution, critical vendor assessment status, key findings]
### Investment Roadmap
| Phase | Investment | Cost | Risk Reduction | RRPD |
|---|---|---|---|---|
| Immediate (0-30 days) | [Quick wins] | [$X] | [$X] | [X.X] |
| Near-term (30-90 days) | [High-priority controls] | [$X] | [$X] | [X.X] |
| Medium-term (90-180 days) | [Program maturity] | [$X] | [$X] | [X.X] |
| Long-term (180-365 days) | [Advanced capabilities] | [$X] | [$X] | [X.X] |
### Regulatory Compliance Status
[Compliance gap summary per applicable regulation]
### Appendices
- A: Detailed NIST CSF 2.0 assessment (all 106 subcategories)
- B: Vulnerability scan summary (redacted)
- C: Third-party vendor risk register
- D: FAIR model assumptions and data sources
- E: Regulatory mapping detail
Quality Checks
