Table of Contents
Cybersecurity Risk Assessments1
| Introduction | 1 |
| The Business Context for Cyber Risk | 2 |
| Core Cybersecurity Concepts and Terminology | 5 |
| Oversight of Cyber Risk | 7 |
| Regulatory, Legal, and Contractual Considerations | 12 |
| Cybersecurity Risk Assessment Methodologies | 15 |
| Establishing the Scope of the Assessment | 19 |
| Asset Identification and Classification | 22 |
| Understanding the Threat Landscape | 28 |
| Vulnerability Identification | 32 |
| Risk Identification and Scenario Development | 37 |
| Assessing Likelihood and Impact | 42 |
| Evaluating Existing Controls | 46 |
| Identity and Access Management Risks | 51 |
| Data Protection and Privacy Risks | 54 |
| Infrastructure, Network, and Endpoint Risks | 57 |
| Cloud, SaaS, and Emerging Technology Risks | 60 |
| Third-Party and Supply Chain Cyber Risks | 64 |
| Human Factors and Security Awareness Risks | 68 |
| Business Resilience | 70 |
| Fraud, Financial Reporting, and Operational Risks from Cyber Events | 75 |
| Risk Prioritization | 77 |
| Risk Treatment Strategies | 80 |
| Reporting Cyber Risk Assessment Results | 84 |
| Monitoring and Reassessment | 86 |
| Common Weaknesses in Cyber Risk Assessments | 90 |
| Summary | 93 |
| Review Questions | 95 |
Answers to Review Questions99
Glossary107
Index108
Course Details
Author: Steven M. Bragg, CPA
Steven Bragg, CPA, has been the chief financial officer or controller of four companies, as well as a consulting manager at Ernst & Young. He received a master’s degree in finance from Bentley College, an MBA from Babson College, and a Bachelor’s degree in Economics from the University of Maine. He has been a two-time president of the Colorado Mountain Club, and is an avid alpine skier, mountain biker, and certified master diver. Mr. Bragg resides in Centennial, Colorado. He has written more than 300 books and courses, including New Controller Guidebook, GAAP Guidebook, and Payroll Management.
Publication/Revision Date: 8/27/2026
Course Exam Questions (online): 40 (multiple-choice)
Program Delivery Method: NASBA QAS Self-Study
Available Formats of Course Text: PDF or PDF plus printed copy sent in the mail
Course Level, Prerequisites, and Advance Preparation Requirements
| License | Course Level | Prerequisites | Advance Preparation Requirements |
|---|
| CPA | Overview | None | None |
* This program is appropriate for professionals at all organizational levels.
Sponsor ID Numbers
National Registry of CPE Sponsors ID: 107615
State CPA Board Sponsor ID Numbers (where applicable)
Florida Division of Certified Public Accounting: 0004761
Hawaii Board of Public Accountancy: 14003
New York State Board for Public Accountancy: 002146
Ohio Accountancy Board: CPE .51 PSR
Pennsylvania State Board of Accountancy: PX178025
Texas State Board of Public Accountancy: 009349
Learning Objectives
As a result of studying the course material, you should be able to meet the objectives listed below:
- Recognize why cybersecurity risk assessments must be connected to business strategy.
- Recall the indicators of a material cyber issue.
- Recognize the value of mapping business processes during an assessment.
- Specify the reasons for documenting assessment scope issues.
- Recall why data classification is needed in an assessment.
- Recognize the risks associated with asset inventory practices.
- Recall why configuration records are needed in an assessment.
- Recognize why cloud data concentration can be a risk for an organization.
- Specify the uses of threat intelligence in a risk assessment.
- Recall why social engineering is a risk.
- Recognize the conditions that can increase ransomware exposure.
- Recall the nature of a cascading cyber risk.
- Recognize the nature of a single-point failure.
- Specify the issues associated with an impact analysis.
- Recall the problems with quantitative risk methods.
- Recognize why existing controls should be evaluated in an assessment.
- Recall why control operation is as important as control design.
- Recognize the different types of access practices, and when to use them.
- Specify the risks associated with deprovisioning.
- Recall the issues with the use of shared credentials.
- Recognize the risks associated with remote access.
- Recall the issues associated with data retention.
- Recognize why backup protection must be included in an assessment.
- Specify the issues related to network architecture risk.
- Recall how hardening can be accomplished.
- Recognize the risks associated with legacy systems.
- Recall the risks related to application programming interfaces.
- Recognize the issues related to the use of SaaS applications.
- Specify the concerns with fourth-party dependencies.
- Recall why vendor concentration should be reviewed as part of an assessment.
- Recognize the issues that can increase the level of human-factor cyber risk.
- Recall the benefits of using well-defined incident reporting channels.
