CYB 410 : 7-2 Project Three Submission: Crafting and Evaluating Risk-Based Recommendations ...

CYB 410 Project Three Guidelines and Rubric

Crafting and Evaluating Risk-Based Recommendations

Overview

How do you make a good risk-informed decision? In this project, you will look at how to craft and evaluate risk-based recommendations. You will examine the processes and methods you can use to make risk-based recommendations, their impact, and the quality of the decisions you’ve made.

Throughout this course and the overall program, you have encountered many real-world breaches. Think about the breaches you have explored and the role that risk management and risk planning played in the outcomes. It is important to review previous breaches across different industries and find commonalities (similar software usage, for example) to make good decisions when evaluating or reevaluating your own organization’s risks. The OPM, Sony, and Target breaches are all useful examples that can help you learn better ways to manage risk and vulnerabilities.

When making risk-informed recommendations, you should look to resources in the form of standards, guidelines, and best practices to help make and assess your decisions. Some resources you might consider are the NIST, the CIS Controls, or the Fundamental Security Design Principles. There are other tools that also help to classify and quantify risk, like the risk register or business impact analysis. When you assess the quality of your decision, also consider how it will affect everyone in the organization.

The project will be submitted in Module Seven.

In this assignment, you will demonstrate your mastery of the following competency:

• Apply decision-quality principles in making risk-informed recommendations

Prompt

You must address the critical elements listed below. The codes shown in brackets indicate the competency to which each critical element is aligned.

1. Risk-Informed Recommendations
   1. Discuss how you can use tools to make risk-informed recommendations. Justify your response with a relevant example.
   2. Discuss how you can use resources to make risk-informed recommendations. Justify your response with a relevant example.
   3. Consider how you can identify and minimize your own bias when making risk-informed recommendations.
   4. Explain how you can use systems thinking to consider the impact of your decision on people, processes, and technology.
   5. Explain what evidence you would use to evaluate whether you made a good decision.