cp-rmm

name

cp-rmm

description

Cybersecurity & Data Privacy Risk Management Model (C|P-RMM) skill for ComplianceForge's SCF-based framework. Use this skill whenever a user wants to: assess cybersecurity or data privacy risk, calculate inherent or residual risk scores, build or update a risk register, perform a risk assessment (DPIA, BIA, PIA, C-SCRA, third-party), score risk using OL/IE/CW/ML/MF factors, map risks to the SP-RMM risk matrix, create POA&M entries, or guide someone through the C|P-RMM 17-step workflow. Trigger whenever you see terms like "risk score", "risk level", "inherent risk", "residual risk", "risk treatment", "CVSS", "occurrence likelihood", "impact effect", "control weighting", "maturity level", "SCF", "POA&M", "risk register", "DPIA", "BIA", or "cybersecurity risk assessment". Even if the user just says "what's the risk of X?" in a security context, this skill applies.

C|P-RMM — Cybersecurity & Data Privacy Risk Management Model

What This Skill Does

This skill helps you apply the ComplianceForge C|P-RMM (version 2025.2) to:

1. Calculate risk scores — both inherent (raw) and residual (weighted, mitigated)
2. Map scores to risk levels — Low / Moderate / High / Severe / Extreme
3. Guide risk assessments — Cybersecurity, DPIA, BIA, PIA, 3rd-party, supply chain
4. Generate risk register entries and POA&M items
5. Walk users through the 17-step C|P-RMM workflow

---

Core Formulas

Inherent Risk (raw, unmitigated)

Inherent Risk = OL × IE
Range: 1–36

Residual Risk (weighted, accounts for controls)

Residual Risk = OL × IE × CW × ML × MF
Range: 0.25–360

Always calculate both. Inherent risk shows the raw exposure; residual risk shows what remains after controls.

---

Scoring Tables

Occurrence Likelihood (OL) — Scale 1–6

Score	Label	Probability
6	Almost Certain	>99%
5	Likely	70–99%
4	Possible	25–70%
3	Unlikely	10–25%
2	Highly Unlikely	1–10%
1	Remote	<1%

Impact Effect (IE) — Scale 1–6

Score	Label	Description
6	Catastrophic	Critical long-term damage; could ruin the business
5	Critical	Critical short-term damage; noticeable market share loss
4	Major	Extensive reputational/financial impact; not ruinous
3	Moderate	Noticeable harm; reputational and financial damage
2	Minor	Localized/minimal damage; minor financial impact
1	Insignificant	Little to no damage or impact

Control Weighting (CW) — Scale 1–10

• Sourced from the SCF (Secure Controls Framework) built-in control weighting values
• Higher weight = more critical control
• When CW is not specified by the user, ask them for it or note it as an assumption

Maturity Level (ML) — Scale 0–5 → mapped to 0.5–1.0

CMM Level	Label	ML Value
0	Not Performed	1.0
1	Performed Informally	1.0
2	Planned & Tracked	0.9
3	Well Defined	0.7
4	Quantitatively Controlled	0.6
5	Continuously Improving	0.5

Lower maturity = higher ML value = higher risk. A CMM-0 org gets no maturity credit.

Mitigating Factors (MF) — Scale 0.5–1.0

Label	Risk Reduction	MF Value
N/A – Not Required	N/A	1.0
No Mitigating Factors Available	0%	1.0
Minimal Impact Reduction	10%	0.9
Moderate Impact Reduction	30%	0.7
Significant Impact Reduction	50%	0.5

---

Risk Level Mapping

Inherent Risk (OL × IE, range 1–36)

Use the risk matrix — find where Occurrence Likelihood (row) intersects Impact Effect (column):

	Insignificant (1)	Minor (2)	Moderate (3)	Major (4)	Critical (5)	Catastrophic (6)
Almost Certain (6)	Moderate	Moderate	High	High	Extreme	Extreme
Likely (5)	Low	Moderate	High	High	Severe	Extreme
Possible (4)	Low	Moderate	Moderate	High	Severe	Severe
Unlikely (3)	Low	Low	Moderate	Moderate	High	Severe
Highly Unlikely (2)	Low	Low	Low	Moderate	Moderate	High
Remote (1)	Low	Low	Low	Low	Moderate	Moderate

Residual Risk (OL × IE × CW × ML × MF, range 0.25–360)

Risk Level	Score Range
Low	0.25 – 36
Moderate	>36 – 108
High	>108 – 198
Severe	>198 – 288
Extreme	>288 – 360

---

How to Use the Calculator Script

A Python script is bundled at scripts/risk_calculator.py. Run it for interactive calculation or call it programmatically:

python scripts/risk_calculator.py

Or call from code:

from scripts.risk_calculator import calculate_inherent_risk, calculate_residual_risk, get_risk_level

---

Slash Commands (Recommended)

The following slash commands can be set up in Claude Code or Cowork to invoke this skill quickly:

/risk-calc

Purpose: Instantly calculate inherent and residual risk scores. How to set up: Create a Claude Code command named risk-calc that loads this skill and prompts:

"Using the C|P-RMM model, calculate inherent risk (OL × IE) and residual risk (OL × IE × CW × ML × MF) for the following scenario. Ask me for each parameter if not provided."

/risk-assess

Purpose: Walk through a full structured risk assessment for a system, process, or third party. How to set up: Create a command named risk-assess that loads this skill and prompts:

"Guide me through a C|P-RMM risk assessment. Start by identifying the system/context, then collect the SSPP details, then assess each applicable risk using the scoring tables. At the end, produce a formatted risk register."

/risk-register

Purpose: Generate a formatted risk register entry or full risk register table. How to set up: Create a command named risk-register that loads this skill and prompts:

"Using the C|P-RMM framework, help me document a risk register entry. Collect the risk ID, threat description, asset affected, OL, IE, CW, ML, MF, inherent score, residual score, risk level, current controls, and recommended treatment."

/risk-treatment

Purpose: Help determine and document a risk treatment decision. How to set up: Create a command named risk-treatment that loads this skill and prompts:

"Given a residual risk score and level, help me select and document the appropriate C|P-RMM risk treatment option: (1) Reduce, (2) Avoid, (3) Transfer, or (4) Accept. Provide justification and next steps."

---

The 17-Step C|P-RMM Workflow

When a user asks to be walked through a full risk assessment, follow these steps in order:

Phase 1 — Establish Foundations (Steps 1–3)

1. Select risk principles — Choose alignment: NIST (SP 800-37/39/IR 8286), ISO 31010, COSO 2019, or OMB A-123
2. Establish dependencies — Set up management dependencies (acceptable risk threshold, POA&M/risk register, data classification) + technology dependencies (inventories, network diagrams, DFDs) + business dependencies (policies, SCRM, trained personnel)
3. Formalize risk practices — Document the Risk Management Program (RMP)

Phase 2 — Build Catalogs (Steps 4–7) 4. Risk Catalog — Document all possible risks affecting the entity 5. Threat Catalog — Identify natural and man-made threats 6. Controls Catalog — Map applicable statutory/regulatory/contractual controls with weighting (SCF recommended) 7. CMM Target — Define "what right looks like" per control using the C|P-CMM maturity model

Phase 3 — Assess (Steps 8–13) 8. Establish SPRE context — Define the Security Protection Risk Environment via SSPP 9. Select assessment rigor — Level 1 (Standard/Low Assurance), Level 2 (Enhanced/Moderate), Level 3 (Comprehensive/High) 10. Use Assessment Objectives (AOs) — Perform conformity assessments against controls 11. Apply assessment method — Examine, Interview, or Test 12. Determine risk — Calculate inherent and residual risk scores 13. Prioritize risks — Priority 1 (Emergency), Priority 2 (Elevated), Priority 3 (Standard)

Phase 4 — Report & Decide (Steps 14–16) 14. Report on Conformity (ROC) — Document: Strictly Conforms / Conforms / Significant Deficiency / Material Weakness 15. Identify management audience — Tier 1 (Line), Tier 2 (Senior), Tier 3 (Executive), Tier 4 (Board) 16. Management determines treatment — Apply one of the 4 risk treatment options

Phase 5 — Implement & Monitor (Step 17) 17. Implement & track — Document risk status (Open/Unacceptable, Open/Acceptable, Closed) and remediate continuously

---

Assessment Types

When the user says they need a specific type of assessment, map to the right framing:

Assessment Type	Focus
Cybersecurity Risk Assessment	General cyber risk posture
Third-Party Risk Assessment	Vendor/supplier controls
DPIA (Data Protection Impact Assessment)	Privacy risks to personal data
BIA (Business Impact Assessment)	Operational continuity impact
PIA (Privacy Impact Assessment)	Regulatory privacy compliance
C-SCRA (Cybersecurity Supply Chain Risk)	Supply chain-specific threats

---

CVSS Integration

When vulnerability data is available (e.g., from a CVE/NVD scan), map CVSS 3.0 scores to Impact Effect:

CVSS 3.0 Rating	Score Range	Suggested IE
Critical	9.0–10.0	6 (Catastrophic) or 5 (Critical)
High	7.0–8.9	5 (Critical) or 4 (Major)
Medium	4.0–6.9	3 (Moderate) or 2 (Minor)
Low	0.1–3.9	2 (Minor) or 1 (Insignificant)
None	0.0	1 (Insignificant)

Use context (how the technology is deployed, what data it touches) to finalize the IE value.

---

Risk Register Output Format

When generating a risk register, use this structure:

| Risk ID | Threat | Asset | OL | IE | CW | ML | MF | Inherent | Residual | Level | Treatment | Status |

Each entry should also include:

• Current controls in place
• Recommended treatment action
• Owner / responsible party
• Target remediation date (for open risks)

---

POA&M Entry Format

When creating Plan of Action & Milestones entries:

POA&M ID:           [unique identifier]
Risk ID:            [linked risk register ID]
Weakness/Finding:   [description of the deficiency]
Inherent Risk:      [OL × IE = score / level]
Residual Risk:      [OL × IE × CW × ML × MF = score / level]
Priority:           [Emergency / Elevated / Standard]
Recommended Action: [specific corrective action]
Responsible Party:  [owner]
Scheduled Completion: [date]
Status:             [Open-Unacceptable / Open-Acceptable / Closed]

---

Tips for Quality Risk Assessments

• Don't skip CW — Control weighting is what separates a meaningful residual score from a shallow one. If the user doesn't know CW, suggest using SCF's built-in weights or defaulting to 5 (medium) with a note.
• Always show your work — Display the full formula with values substituted (e.g., 4 × 5 × 7 × 0.9 × 0.7 = 88.2) so the user can verify and audit.
• Both scores matter — Inherent tells you the raw exposure; residual tells you what's left after controls. Both belong in a risk register.
• CMM 0 and CMM 1 are equal — Both get ML = 1.0 (no maturity credit). CMM 2 is the first level where you get any reduction.
• Ask about context — The same CVSS 9.8 vulnerability means very different things on an air-gapped lab machine vs. an internet-facing payment server.

---

Reference Files

• references/scoring-tables.md — Full scoring reference tables for quick lookup
• references/workflow-guide.md — Detailed 17-step workflow with prompts and questions for each step
• scripts/risk_calculator.py — Python calculator for inherent and residual risk