UST LOGO

Hands -on Risk management Framework

A course by

EA
100.00$
  • Level
    All Levels
  • Last Updated
    June 2, 2026
  • Certificate
    Certificate of completion
Course Duration: 0

Tags

📚 Lectures
0 (0 Ratings)
Course level:All Levels
Categories ADVANCED & SPECIALIZATION MEMBERSHIP

Description

The Hands-on Risk Management Framework course is a practical, step-by-step immersion into how risk is identified, assessed, categorized, and managed within real organizational environments. This is not theory-based learning. This course focuses on applied risk management using structured frameworks and real-world scenarios. Students will learn how to translate regulatory requirements into actionable risk processes, conduct…

To access this content, you must purchase Advanced and Specialization - monthly or Advanced and Specialization - yearly.

Requirements

  • • Recommended completion of Introduction to GRC and Introduction to Core Regulatory Frameworks
  • • Basic understanding of governance, risk, and compliance concepts
  • • Willingness to follow practical demonstrations and build documentation step-by-step
  • • Designed to prepare students for advanced framework implementation and professional GRC roles

Target Audience

  • • GRC professionals who want hands-on experience with risk management frameworks
  • • Cybersecurity professionals transitioning into risk and compliance roles
  • • Students who completed Introduction to GRC and Regulatory Foundations
  • • Professionals preparing to work with frameworks such as NIST RMF, ISO 27001, and enterprise risk programs
  • • Anyone who wants to understand how risk management and security documentation are built in real organizations

What I will learn?

  • By the end of this course, students will be able to:
  • • Understand how risk management frameworks operate in real organizational environments
  • • Conduct structured risk assessments using practical risk evaluation techniques
  • • Identify assets, threats, vulnerabilities, likelihood, and impact within risk scenarios
  • • Build and document risks using professional tools such as risk registers and risk matrices
  • • Evaluate control effectiveness and identify control gaps
  • • Translate regulatory and framework requirements into actionable risk management processes
  • • Build a System Security Plan (SSP) from scratch using structured framework guidance
  • • Create supporting documentation used in real compliance programs, including risk assessments, control documentation, and security artifacts
  • • Understand how risk management documentation supports audits, authorization, and compliance reviews
  • • Communicate risk findings clearly for leadership decision-making

Course Curriculum

Foundations of Risk: Understanding Threats, Vulnerabilities & Impact
This foundational module introduces the core concepts that underpin risk management frameworks. Students will learn the critical differences between threats, vulnerabilities, risks, likelihood, and impact, and how these components interact within real organizational environments. The module also explores the CIA Triad (Confidentiality, Integrity, Availability) as the backbone of information security risk evaluation. By mastering these fundamentals, students will be prepared to apply structured risk management methodologies with clarity and confidence.

  • Understanding Vulnerabilities: Identifying Weaknesses in Systems
    08:55
  • Understanding Threats: Identifying Sources of Potential Harm
    08:38
  • Likelihood and Impact: Evaluating Risk Severity
    10:03
  • What Is Risk? Understanding the Core of Risk Management
    08:03
  • What Is Confidentiality? Protecting Sensitive Information
    08:19
  • What Is Integrity? Ensuring Accuracy and Trust in Information
    06:42
  • What Is Availability? Ensuring Access to Systems and Information
    04:55
  • How This Connects to RMF
    06:22
  • Mastering Information Categorization: Live Demonstration (NIST 800-60 Vol II & FIPS 199)
    01:51:05
  • Case Study 1: Federal Health Information Management System (FHIMS) — Security Categorization & SSP Development
  • Case Study 2: Federal Law Enforcement Data System (FLEDS) — Categorization Error Review & SSP Correction
  • Case Study 3: Federal Revenue & Payment Modernization System (FRPMS) — Post-Upgrade Re-Categorization & SSP Update
  • Privacy Threshold Analysis (PTA)
    24:56
  • Privacy Threshold Analysis (PTA) — What It Is, Why It Matters & Its Role in the ATO Package
    21:02
  • Privacy Threshold Analysis PTA Project Guidance
    08:00
  • Privacy Threshold Analysis (PTA) — Three Federal Systems
  • NIST SP 800-53 Rev. 5 Explained: Security Controls Deep Dive for GRC Analysts
    47:07
  • Introduction to NIST SP 800-53B — Control Baselines
    29:00
  • NIST SP 800-53B — Control Baselines Knowledge Check
  • NIST SP 800-53r5 Control Mastery — Group Presentation Assignment
  • Group Assignment 5 — Privacy Impact Assessment (PIA) + Teaching Briefing
  • Writing SOPs from NIST Controls — Understanding ODPs and Using STIG Viewer
    22:00
  • Building a Federal SOP — FHIMS Access Control Case Study
    10:00
  • Writing NIST 800-53 SOPs: From Control Text to Audit-Ready Document- A guided workshop on AC-1 and AC-2
    20:00
  • FHIMS SOP Writing — Group Assignment 2 (20 Control Families)
  • Control Implementation Status & Inheritance
    25:00
  • Writing Implementation Statements Line by Line: AC-1 and AC-2 in a Real SSP
    25:00
  • Writing NIST 800-53 Implementation Statements: The AC Family (AC-5 to AC-8)
    16:00
  • From Your SOPs to Implementation Statements
  • Building a Privacy Impact Assessment: Mapping the Information Lifecycle to the NIST SP 800-53B Privacy Control Baseline
    10:00
  • Complete a Privacy Impact Assessment (PIA)
  • SSP Walkthrough
    12:00
  • Build Your Own SSP
  • POA&M Walkthrough
    07:00
  • Build a POA&M for Your System

Information System Categorization: Determining Impact Levels and Security Requirements
This topic introduces the process of categorizing information systems to determine their appropriate impact levels based on confidentiality, integrity, and availability requirements. It explains how organizations assess potential consequences of system compromise and assign low, moderate, or high impact ratings in alignment with regulatory standards. Proper system categorization serves as the foundation for selecting security controls, managing risk effectively, and ensuring compliance within the Risk Management Framework (RMF).

Student Ratings & Reviews

No Review Yet
No Review Yet