A defensible decision is one you can explain and support later with evidence. It does not claim to predict the future. Anyone reviewing it, such as an auditor, an executive, or a regulator, should find who owned the system, what was assessed, who decided, and when it will be reviewed again. NorthBridge writes these expectations into policy, and this made-up policy excerpt shows the six elements every system needs:
Picture the risk team at NorthBridge Benefits, a 900-employee US health insurance administrator. During a routine vendor review, an analyst notices that members have been logging into a customer portal for eight months. Nobody on the team has ever assessed it. No owner is named, no risk is recorded, and no one has signed off on it.
This course teaches you to turn a discovery like this into a defensible cyber risk decision. You will work with four sources. NIST Special Publication (SP) 800-30 Revision 1 guides how to run a risk assessment. ISO/IEC 27005 covers how risks are identified, analyzed, evaluated, and treated. The NIST Cybersecurity Framework (CSF) 2.0 helps communicate where the organization stands. FAIR (Factor Analysis of Information Risk) puts risk in money terms.
A system without an assessment still carries risk. The risk is simply unmeasured, and nobody is accountable for it. At NorthBridge, the portal holds protected health information (PHI), which is health data tied to a person. Here is how one gap leads to costs the business must carry: