Software Engineering Institute

In this course, students learn how to construct a risk management program within the three fundamental pillars of governance, appetite, and policy. Specifically, the course will educate the student on how best to structure decision-makers in the organization to gain the risk information they need to be more effective. Furthermore, the audience will learn how to quantitatively communicate their expectation for risk response through documented risk appetite. Finally, the student will also learn tips and tricks for structuring policy and procedure for program execution. This course uses the latest model in the Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)--the Facilitated process for managing Operational Risks Tailored for the Enterprise (FORTE). OCTAVE FORTE helps your organization assess its technical risks and build an enterprise risk management (ERM) program using a process that spans the entire risk management lifecycle from identification through closure. The course concludes with a workshop for students that provides them with the opportunity to develop their own assets to include a model for their risk governance structure, a risk appetite statement, and a draft risk management program policy.

This course is targeted to executives, managers, and technical staff who play a decision making role in the enterprise. This may include members of the following functions:

• Security
• Information security
• Information systems
• Strategy
• Risk management
• Operations

At the completion of the course, learners will be able to draft and publish a complete policy and procedure that informs an organization on how to conduct proper risk management. This may be specifically tailored for a cyber risk management program or elevated to an enterprise risk management related policy that addresses all risks in an organization in a consistent and standardized manner.

• Fundamental Principles of Risk Management
• Establishing a program for risk-based decision making
• Governance structure
• Risk appetite development and application
• Policy and procedure development

Course materials include slides and templates utilized for policy and tool development.

Before registering for this course, it is recommended that students understand and list the strategic objectives for their organization. If confidential or not practical, the course will provide example use cases for application of tools.