GRC › Module 2 › Lesson 1
Risk Assessment
Risk assessment literacy names asset identification, threat scenarios, vulnerability linkage, and inherent vs residual risk — draft assessment rows on YOUR $GRC_LAB fictional org before treatment decisions.
Visual · t37_risk_assessment
Risk assessment literacy. $GRC_LAB only. Original Cyberlium.
Opening
You cannot treat what you have not named — literacy teaches risk assessment steps so fictional org scenarios on $GRC_LAB get documented before control mapping.
Risk assessment identifies assets, threats, vulnerabilities, and existing controls — then estimates likelihood and impact to prioritize treatment. On Cyberlium you practice on fictional systems in YOUR $GRC_LAB org template — lab CRM, example.local API, training file share — never paste real employer incident data or customer breach details into assessment notes. Cyberlium maps risk assessment rows on YOUR $GRC_LAB — asset, threat, vulnerability, inherent risk label for one fictional system. Next: Qual vs Quant.
1. Risk assessment steps (named)
Scope: define assessment boundary on YOUR fictional org. Identify: assets, data classes, owners. Analyze: threat scenarios and vulnerabilities. Evaluate: likelihood and impact — qualitative or quantitative. Document: inherent risk before controls, residual after treatment.
On $GRC_LAB, write assessment row — asset, threat, vulnerability, inherent risk for one fictional lab system.
Command guide
Try these commands — Risk assessment steps (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST CSF Identify — https://www.nist.gov/cyberframework ISO 27001 risk — https://www.iso.org/isoiec-27001-information-security.html ISACA risk glossary — https://www.isaca.org/resources/glossary
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export GRC_LAB=${GRC_LAB:-$HOME/cyberlium-lab/t37-grc}
curl -sS https://www.nist.gov/cyberframework | head -10
cat > "$GRC_LAB/notes/risk-assessment-named.txt" <<'EOF'
Risk assessment — NAMED LITERACY:
Asset: what you protect (data, systems, people, reputation)
Threat: what could go wrong (malware, insider, misconfig, vendor breach)
Vulnerability: weakness exploited (unpatched, weak MFA, logging gap)
Risk: likelihood × impact on confidentiality, integrity, availability
Context: LAB-ORG-001 fictional SaaS — scope YOUR lab templates only
Lab: populate risk register CSV in Module 3 — not real customer data
EOFCommand — copy this
grep -E 'Asset|Threat|likelihood|LAB-ORG-001' "$GRC_LAB/notes/risk-assessment-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: NIST CSF Identify (https://www.nist.gov/cyberframework); ISO 27001 risk (https://www.iso.org/isoiec-27001-information-security.html); ISACA risk glossary (https://www.isaca.org/resources/glossary). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why assessment precedes treatment
Treatment without assessment wastes budget on low-priority gaps. Shared assessment vocabulary aligns security, IT, and business owners on the same risk ID. Version-controlled assessment notes survive auditor questions on lab templates.
Students draft lab assessment rows on notes — production assessments follow org methodology and management sign-off.
3. Lab boundary
Forbidden: copying real breach postmortems into lab assessments as if fictional. Allowed: risk assessment card — one row with $GRC_LAB fictional system example.
Ship: risk assessment row for YOUR lab org system. Next: Qual vs Quant.
4. What you ship: risk assessment row for $GRC_LAB
Asset, threat, vulnerability, inherent risk. $GRC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Risk assessment row. $GRC_LAB named. File t37-m02-l01-risk-assessment.txt chmod 600.
6. Wrong vs right: fraudulent certs vs YOUR lab templates
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Paste employer incident report into lab assessment. Skip asset identification because 'it's obvious.'
Right
Write risk assessment row for YOUR $GRC_LAB fictional system. Next: Qual vs Quant.
Mission: draft risk assessment on YOUR lab org
1) Name one fictional asset and data class. 2) Write threat and vulnerability. 3) Label inherent risk qualitatively. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Assessment rows need asset names — vague 'the server' fails auditor readability.
Knowledge Check
APPLY: Risk assessment on Cyberlium primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Inherent risk is estimated before control treatment.
True or False
Knowledge Check
APPLY: Risk assessment literacy on Cyberlium uses:
Multiple choice