Day 2 of 22Governance, Risk & Compliance· ~60 min

Build a risk register from 12 asset scenarios

Scenario

You've just completed a rapid asset-discovery workshop at NimbusStack. You captured 12 assets/scenarios that need to enter the risk register: 1. Production PostgreSQL DB (customer PII, hosted on AWS Mumbai) 2. Salesforce CRM (contains all lead data) 3. Shared engineering AWS-root credentials (2 senior engineers know the password) 4. GitHub org (public + private repos, no branch protection) 5. Vendor-managed HR tool (Zoho People) with all salaries 6. Founder's personal laptop (mixed personal + work, no MDM) 7. Contract signing on personal WhatsApp 8. Public-facing customer portal (Node.js, last pentest 18 mo ago) 9. Slack workspace (no data retention policy) 10. Backup S3 bucket (encrypted, versioning off) 11. Third-party analytics SDK embedded in the SaaS app (US company) 12. Office WiFi (shared password on a printed sign)

Your role

You are the CISO. Board wants a risk register with prioritised treatments.

Your task

Produce a risk register table with columns: - Asset - Threat scenario - Likelihood (High / Medium / Low) - Impact (High / Medium / Low) - Inherent risk score - Treatment (Mitigate / Transfer / Accept / Avoid) - Top 3 controls to implement

Deliverable format: Markdown table with 12 rows, one per asset

Toolkit

  • Risk scoring: Inherent = Likelihood × Impact (5x5 heat map: H=5, M=3, L=1)
  • Treatment options: Mitigate (add control), Transfer (insurance/vendor), Accept (document + monitor), Avoid (stop the activity)
  • Ranking: risks above score 12 are Critical, 6-11 High, 3-5 Medium, ≤2 Low

Success criteria (what the AI grades against)

  • Table has all 12 rows
  • Likelihood + Impact justified (not both High for every asset)
  • Root credential + shared WiFi + WhatsApp signing correctly flagged as CRITICAL
  • Controls are specific (not 'improve security') — e.g. 'implement AWS SSO with MFA', 'deploy Jumpcloud MDM'
  • At least one 'accept' or 'transfer' treatment (shows the student understands not every risk needs mitigation)
  • Backup S3 without versioning identified as a business-continuity risk

Log in to submit your deliverable for AI review.

Log in / Register