Case Studies & Templates

Threat & Risk Assessment Report Template
════════════════════════════════════════

1. EXECUTIVE SUMMARY
   1.1 Assessment purpose and trigger
   1.2 Scope and boundaries
   1.3 Key findings summary (top 5 risks with ALE)
   1.4 Overall risk posture rating
   1.5 Investment recommendations with ROI

2. ASSESSMENT CONTEXT
   2.1 System description and architecture
   2.2 Business context and value
   2.3 Regulatory environment
   2.4 Previous assessment findings (if applicable)
   2.5 Assessment methodology and framework used

3. SCOPE & DECOMPOSITION
   3.1 System boundary diagram
   3.2 Component inventory
   3.3 Data flow diagrams
   3.4 Trust boundaries
   3.5 Crown jewels and critical assets (CIA ratings)
   3.6 Exclusions and inherited risks

4. THREAT LANDSCAPE
   4.1 Relevant threat actors (profiled)
   4.2 Industry threat intelligence
   4.3 ATT&CK technique mapping
   4.4 Threat scenarios (structured)

5. VULNERABILITY & ATTACK SURFACE
   5.1 Attack surface inventory
   5.2 Technical vulnerabilities
   5.3 Architecture weaknesses
   5.4 Process and control gaps
   5.5 Supply chain vulnerabilities

6. RISK ANALYSIS
   6.1 Risk assessment methodology (FAIR/800-30)
   6.2 Risk register (full)
   6.3 Risk heat map (for visual reference only)
   6.4 FAIR quantification results for top risks
   6.5 Monte Carlo simulation outputs

7. RISK TREATMENT PLAN
   7.1 Treatment decisions per risk
   7.2 Control recommendations with cost estimates
   7.3 Implementation roadmap (30/60/90 day)
   7.4 Risk acceptance decisions needed
   7.5 Residual risk after treatment

8. APPENDICES
   A. Detailed threat scenarios
   B. Attack trees
   C. FAIR analysis worksheets
   D. Control mapping to frameworks
   E. Regulatory compliance mapping
   F. Glossary of terms

Pre-Assessment Checklist
════════════════════════
□ Assessment purpose and trigger documented
□ Scope boundaries defined and agreed
□ Stakeholders identified and briefed
□ Framework selected (NIST/ISO/OCTAVE/hybrid)
□ Previous assessment reports reviewed
□ Architecture documentation collected
□ Regulatory requirements identified
□ Assessment timeline and milestones set
□ Risk appetite statement obtained from leadership

During-Assessment Checklist
═══════════════════════════
□ System decomposition complete (DFD, components, data flows)
□ Crown jewels analysis performed
□ Threat landscape documented (actors, TTPs, CTI)
□ Threat modeling performed (STRIDE/PASTA/hybrid)
□ Attack surface mapped (all six categories)
□ Vulnerabilities correlated with threats
□ Risk quantification completed (FAIR for top risks)
□ Risk register populated with all findings
□ Treatment options analyzed with cost-benefit

Post-Assessment Checklist
═════════════════════════
□ Executive summary written (1-page max)
□ Full report with all appendices compiled
□ Risk register finalized with owners assigned
□ Treatment plan with 30/60/90 day milestones
□ Risk acceptance forms prepared for leadership
□ Findings briefed to technical team
□ Executive presentation delivered
□ Risk register loaded into GRC tool
□ Follow-up reassessment date scheduled
□ Lessons learned documented