Lab 01 — Build an AI-Assisted Enterprise Risk Assessment

Welcome to your first hands-on lab in:

AI for GRC Professionals

In this lab, you will perform an end-to-end enterprise cybersecurity risk assessment.

You will use AI to help you:

Understand
Business Context

      ↓

Identify
Assets and Threats

      ↓

Develop
Risk Scenarios

      ↓

Analyze
Likelihood and Impact

      ↓

Review
Existing Controls

      ↓

Determine
Candidate Residual Risk

      ↓

Develop
Treatment Options

But throughout the lab, remember:

AI
Supports Analysis

      ↓

GRC Analyst
Validates

      ↓

Risk Owner
Makes the Decision

Mission Information

Mission

You have joined:

CloudNova Technologies

as a:

Cybersecurity
GRC Analyst

CloudNova operates a SaaS platform used by enterprise customers.

The organization is rapidly expanding its cloud environment and has asked the GRC team to perform a cybersecurity risk assessment of its production platform.

Your mission is to:

Identify

Analyze

Document

Evaluate

Treat

the most important cybersecurity risks affecting the platform.

You will use AI as an:

Risk Analysis
Assistant

but all material conclusions must be validated by you.

Scenario

CloudNova provides a cloud-hosted customer management platform.

The environment is hosted primarily in:

AWS

The production platform contains:

Customer Information

Application Data

Authentication Data

Business Records

System Logs

The platform is considered:

Business Critical

because customers depend on it for daily operations.

CloudNova currently has:

200 Employees

45 Engineers

12 Cloud Administrators

3 Security Engineers

1 GRC Analyst

Environment Overview

The production architecture includes:

Internet Users
      ↓
Web Application
      ↓
Application Load Balancer
      ↓
Application Servers
      ↓
Managed Database
      ↓
Object Storage

Administrative access is performed through:

Corporate Identity Provider
      ↓
Cloud Roles
      ↓
AWS Production Accounts

Security services include:

Cloud Logging

Endpoint Protection

Vulnerability Scanning

MFA

Security Monitoring

However, several recent observations have raised concerns.

Current Observations

The following information was identified during an internal review.

Observation 1 — Privileged MFA

CloudNova has:

12
Privileged
Cloud Administrators

Three privileged administrator accounts currently do not have MFA enforced.

Observation 2 — Vulnerability Management

The production environment contains:

8 Critical
Vulnerabilities

that have remained unresolved for more than:

45 Days

Observation 3 — Public Storage

One cloud storage bucket containing:

Customer Export Files

was identified as publicly accessible.

The exposure was corrected after discovery.

Observation 4 — Logging

Cloud activity logs are enabled.

However:

Centralized
Security Monitoring

does not currently cover all production accounts.

Observation 5 — Backup

Daily database backups are configured.

However, the organization has not performed a full:

Disaster Recovery
Restore Test

during the last 12 months.

Observation 6 — Third-Party Access

A managed service provider has administrator access to selected production systems.

The vendor accounts are manually reviewed.

There is no formal:

Privileged Access
Management

platform.

Lab Objectives

By completing this lab, you will learn how to:

define business context before assessing risk.
identify critical assets.
distinguish threats, vulnerabilities and risks.
develop structured cybersecurity risk scenarios.
use AI to support risk discovery.
prevent AI from inventing unsupported facts.
analyze existing controls.
identify missing information.
perform qualitative likelihood analysis.
perform qualitative impact analysis.
determine inherent risk.
analyze control effectiveness.
estimate candidate residual risk.
develop risk treatment options.
create a professional enterprise risk register.
prepare an executive risk summary.
validate AI-generated risk analysis.

Prerequisites

Before starting, you should understand:

Risk

Threat

Vulnerability

Control

Likelihood

Impact

Inherent Risk

Residual Risk

Risk Treatment

You should also have completed:

05 — AI-Assisted Risk Assessment
and Risk Register Management

Tools Required

You may use:

Generative AI Assistant

Spreadsheet Software

Markdown / Text Editor

Optional:

Python

for risk-register analysis.

Lab Artifacts

By the end of this lab, you should create:

01 Business Context

02 Asset Inventory

03 Threat Register

04 Risk Scenario Register

05 Risk Assessment Worksheet

06 Enterprise Risk Register

07 Risk Treatment Plan

08 Executive Risk Summary

Part 1 — Understand the Business Context

Risk does not exist in isolation.

Before asking:

What Could
Go Wrong?

you first need to understand:

What Matters
to the Business?

Step 1 — Identify Business Objectives

For CloudNova, candidate objectives include:

Provide Reliable
Customer Service

Protect Customer Data

Maintain Production
Availability

Meet Contractual
Commitments

Protect Company
Reputation

Create:

Business_Context.md

with:

Organization

Business Service

Business Objectives

Critical Processes

Critical Data

Major Dependencies

Step 2 — Ask AI to Organize the Context

Use:

ROLE

Act as a cybersecurity
GRC risk analysis assistant.

CONTEXT

CloudNova operates
a business-critical
SaaS platform hosted
in AWS.

INPUT

Use only the supplied
business and technical
information.

TASK

Identify:

Business Objectives

Critical Services

Critical Data

Technology Dependencies

Third-Party Dependencies

Missing Information

CONSTRAINTS

Do not invent
business facts.

Mark unknown information
as:

Needs Validation

Validation Checkpoint

Review every AI-generated statement.

Ask:

Was This
Provided?

If not:

Remove It

or

Mark It
Needs Validation

Expected Outcome

You should have a structured view similar to:

Category	Item
Business Service	CloudNova SaaS Platform
Criticality	Business Critical
Primary Cloud	AWS
Critical Data	Customer information
Identity Dependency	Corporate Identity Provider
Third Party	Managed Service Provider
Monitoring	Partial centralized coverage
Recovery	Backups exist, restore test overdue

Part 2 — Build the Asset Inventory

Risk affects something of value.

These are:

Assets

Step 3 — Identify Assets

From the scenario, identify:

Customer Data

Web Application

Application Servers

Production Database

Object Storage

Cloud Accounts

Privileged Identities

Security Logs

Backups

Identity Provider

Step 4 — Create Asset Inventory

Create:

Asset_Inventory.csv

with:

Asset ID	Asset	Type	Business Criticality	Data	Owner
AST-001	SaaS Platform	Application	Critical	Customer Data	TBD
AST-002	Production Database	Database	Critical	Customer Data	TBD
AST-003	Cloud Admin Accounts	Identity	Critical	Administrative Access	TBD

Do not invent owners.

Use:

TBD

where information is unavailable.

Step 5 — Ask AI to Identify Missing Assets

Prompt:

Review the supplied
architecture and asset list.

Identify assets
that are explicitly
present in the scenario
but missing from
the current inventory.

Do not infer
assets that were
not described.

Part 3 — Identify Threats

A threat is something capable of causing harm.

Step 6 — Build Threat Register

Candidate threats include:

External Attacker

Credential Theft

Malicious Insider

Ransomware

Cloud Misconfiguration

Vulnerability Exploitation

Third-Party Compromise

Service Failure

Create:

Threat_Register.csv

with:

Threat ID	Threat	Relevant Assets	Evidence / Basis
THR-001	Credential compromise	Privileged identities	MFA gaps
THR-002	External exploitation	Production servers	Critical vulnerabilities
THR-003	Unauthorized data access	Object storage	Public bucket finding

Important

Do not confuse:

Threat

with:

Risk

Example:

Threat:
External Attacker

Risk:

An external attacker
could exploit an
unpatched production
system and gain
unauthorized access,
resulting in customer
data exposure or
service disruption.

Part 4 — Identify Vulnerabilities and Risk Conditions

Step 7 — Build Condition Register

Create:

Risk_Conditions.csv

Example:

Condition ID	Condition	Source
CON-001	3 privileged accounts without enforced MFA	Observation 1
CON-002	8 critical vulnerabilities older than 45 days	Observation 2
CON-003	Public storage exposure occurred	Observation 3
CON-004	Incomplete centralized monitoring coverage	Observation 4
CON-005	DR restore test not completed in 12 months	Observation 5
CON-006	Third-party admin access lacks formal PAM	Observation 6

Step 8 — Distinguish Issue from Risk

Example:

3 Administrator
Accounts Lack MFA

is:

A Current
Control Gap

It is not yet the complete risk statement.

Part 5 — Generate Candidate Risk Scenarios

Now use AI to combine:

Asset
+
Threat
+
Condition
+
Impact

Step 9 — Risk Discovery Prompt

Use:

ROLE

Act as a cybersecurity
risk analysis assistant.

CONTEXT

CloudNova operates
a business-critical
AWS-hosted SaaS platform.

INPUT

Use only:

Business Context

Asset Inventory

Threat Register

Risk Conditions

TASK

Identify plausible
cybersecurity risk scenarios.

For each scenario provide:

Risk ID

Asset

Threat

Condition

Risk Event

Potential Business Impact

Existing Controls

Missing Information

CONSTRAINTS

Do not invent
controls.

Do not invent
incidents.

Do not assign
final risk ratings.

Clearly identify
assumptions.

Step 10 — Review Candidate Risks

You should identify risks similar to:

RISK-001 — Privileged Account Compromise

A malicious actor
could compromise a
privileged administrator
account that does not
have MFA enforced,
gain unauthorized access
to production cloud
resources and expose
or modify customer data.

RISK-002 — Critical Vulnerability Exploitation

An external attacker
could exploit unresolved
critical vulnerabilities
in production systems,
resulting in unauthorized
access, service disruption
or data compromise.

RISK-003 — Cloud Storage Exposure

A cloud storage
misconfiguration could
expose customer export
files to unauthorized
internet users,
resulting in customer
data disclosure.

RISK-004 — Inadequate Security Monitoring

Malicious activity
within an unmonitored
production account
could remain undetected
for an extended period,
increasing the potential
impact of a security
incident.

RISK-005 — Recovery Failure

A major production
failure or destructive
cybersecurity event
could require restoration
from backup, but recovery
may take longer than
expected because the
full restore process
has not recently
been validated.

RISK-006 — Third-Party Privileged Access

Compromise or misuse
of a managed service
provider administrator
account could result
in unauthorized access
to production systems
because privileged
third-party access is
not governed through
a formal PAM process.

Step 11 — Validate Each Risk

For every risk, verify:

Threat Exists?

Asset Exists?

Condition Exists?

Impact Is Plausible?

Control Was Actually Provided?

Remove unsupported statements.

Part 6 — Define the Risk Assessment Methodology

For this lab, use a simple:

5 × 5
Risk Matrix

Likelihood Scale

Score	Likelihood	Definition
1	Rare	Event is highly unlikely
2	Unlikely	Event could occur but is not expected
3	Possible	Event could reasonably occur
4	Likely	Event is expected to occur under current conditions
5	Almost Certain	Event is highly likely or repeatedly expected

Impact Scale

Score	Impact	Definition
1	Insignificant	Minimal business impact
2	Minor	Limited operational or business impact
3	Moderate	Noticeable business, customer or operational impact
4	Major	Significant operational, financial, customer or compliance impact
5	Severe	Critical enterprise impact

Risk Calculation

Likelihood
      ×
Impact
      =
Risk Score

Risk Rating

Score	Rating
1–4	Low
5–9	Medium
10–16	High
17–25	Critical

Important Lab Rule

AI may help:

Analyze Factors

but you must assign the final scores for the lab.

Part 7 — Assess Inherent Risk

Inherent risk asks:

What Is the Risk
Before Considering
Existing Controls?

Step 12 — Analyze Likelihood Factors

For each risk, consider:

Exposure

Threat Capability

Existing Condition

Attack Surface

Historical Information

Technology

Do not invent incident history.

AI Likelihood Prompt

Using the supplied
risk scenario and
the approved likelihood
scale:

Identify evidence
that could support
each relevant likelihood
level.

Identify missing
information.

Do not select
the final likelihood.

Step 13 — Select Likelihood

Example for RISK-001:

Condition:
3 privileged accounts
without MFA

Potential Threat:
Credential compromise

Exposure:
Production administrative access

You might select:

Likelihood = 4
Likely

but document your reasoning.

Step 14 — Analyze Impact

Use:

Using the supplied
risk scenario and
the approved impact
scale:

Identify potential
business impact across:

Confidentiality

Integrity

Availability

Customer Impact

Operational Impact

Compliance Impact

Do not exaggerate
impact.

Do not assign
the final rating.

Step 15 — Select Impact

For RISK-001, you may determine:

Impact = 5
Severe

if privileged access could materially affect production and customer data.

Again, record the justification.

Step 16 — Calculate Inherent Risk

Example:

Likelihood = 4

Impact = 5

Inherent Risk
=
20

Rating:
Critical

Part 8 — Review Existing Controls

Now identify controls already present.

Step 17 — Build Control Register

From the scenario, existing controls include:

Corporate Identity Provider

MFA

Cloud Logging

Endpoint Protection

Vulnerability Scanning

Daily Database Backups

Manual Vendor Access Review

Create:

Control_Register.csv

Control ID	Control	Type	Related Risk	Evidence
CTRL-001	MFA	Preventive	RISK-001	Configuration
CTRL-002	Vulnerability scanning	Detective	RISK-002	Scan report
CTRL-003	Cloud logging	Detective	RISK-004	Cloud log config
CTRL-004	Daily backups	Recovery	RISK-005	Backup records

Step 18 — Evaluate Control Limitations

Example:

Control:
MFA

Limitation:
Not enforced
for all privileged
accounts

Another:

Control:
Logging

Limitation:
Not centrally monitored
across all production
accounts

Step 19 — Ask AI for Control Coverage Analysis

For each validated
risk scenario:

Review the supplied
controls.

Identify:

Preventive Controls

Detective Controls

Responsive Controls

Recovery Controls

Control Limitations

Potential Coverage Gaps

Do not assume
control effectiveness.

Part 9 — Assess Residual Risk

Residual risk considers:

Risk
      ↓
Existing Controls
      ↓
Remaining Exposure

Step 20 — Reassess Likelihood

Consider whether controls reduce:

Probability

of the scenario.

Example:

MFA exists for many privileged users, but three accounts remain uncovered.

Likelihood may reduce from:

to:

depending on your assessment.

Step 21 — Reassess Impact

Controls may or may not reduce impact.

Example:

Monitoring may help reduce:

Incident Duration

but may not prevent the initial compromise.

Step 22 — Calculate Residual Risk

Example:

Residual Likelihood:
3

Residual Impact:
5

Residual Score:
15

Residual Rating:
High

Part 10 — Build the Enterprise Risk Register

Create:

Enterprise_Risk_Register.csv

with:

Field
Risk ID
Risk Title
Risk Statement
Asset
Threat
Condition
Business Impact
Existing Controls
Control Limitations
Inherent Likelihood
Inherent Impact
Inherent Score
Inherent Rating
Residual Likelihood
Residual Impact
Residual Score
Residual Rating
Risk Owner
Treatment
Target Date
Status

Example Entry

Risk ID:
RISK-001

Title:
Privileged Cloud
Account Compromise

Risk Statement:
A malicious actor
could compromise a
privileged account
without MFA enforcement,
gain unauthorized access
to production resources
and expose or modify
customer information.

Asset:
AWS Production Environment

Threat:
Credential Compromise

Condition:
3 privileged
administrator accounts
without MFA

Inherent Risk:
20 — Critical

Existing Controls:
Corporate IdP
Partial MFA
Cloud Logging

Residual Risk:
15 — High

Owner:
TBD

Part 11 — Develop Risk Treatment Options

Common treatment approaches:

Avoid

Reduce

Transfer

Accept

For most risks in this lab, reduction is likely to be relevant.

Step 23 — Generate Treatment Options

Prompt:

For the validated
risk scenario:

Generate candidate
risk treatment options.

Classify them as:

Avoid

Reduce

Transfer

Accept

For each provide:

Action

Expected Benefit

Limitation

Dependency

Potential Evidence
of Completion

Do not select
the final treatment.

Do not accept
the risk.

Example — RISK-001

Potential reduction actions:

Enforce MFA
for all privileged
accounts

Implement PAM

Remove standing
administrative privileges

Introduce time-limited
privileged access

Improve privileged
activity monitoring

Step 24 — Build Treatment Plan

Create:

Risk_Treatment_Plan.csv

with:

Risk ID	Action	Owner	Priority	Target Date	Evidence	Status
RISK-001	Enforce MFA for all admins	TBD	High	TBD	IAM config	Proposed
RISK-001	Evaluate PAM implementation	TBD	Medium	TBD	PAM design	Proposed

Part 12 — Identify Risk Owners

Risk should not automatically be owned by:

GRC

The risk owner should be someone with:

Business
or
Operational Authority

to manage the exposure.

For this lab, where ownership is unknown, use:

TBD

Then identify the likely organizational role requiring confirmation.

Part 13 — Build Risk Treatment Priorities

A simple model:

Critical
      ↓
Immediate Management Attention

High
      ↓
Prioritized Remediation

Medium
      ↓
Planned Treatment

Low
      ↓
Monitor

Use your organization’s approved methodology in real environments.

Part 14 — Perform Risk Register Quality Review

Ask AI:

Review the supplied
risk register.

Identify:

Duplicate Risks

Weak Risk Statements

Missing Owners

Missing Controls

Missing Treatments

Missing Review Dates

Inconsistent Ratings

Unsupported Assumptions

Do not change
the register.

Validation Checkpoint

For every issue flagged by AI:

Verify
Before Changing
the Risk Register

Part 15 — Risk Correlation

Now look across the risks.

You may notice:

RISK-001
Privileged MFA

RISK-004
Monitoring Gaps

RISK-006
Vendor Privileged Access

all relate to:

Identity
and
Privileged Access

This may indicate a broader:

Identity Governance
Risk Theme

Step 25 — Theme Analysis

Prompt:

Analyze the validated
risk register.

Identify common
risk themes.

For each theme
provide:

Related Risk IDs

Common Assets

Common Controls

Common Conditions

Potential Systemic Issue

Do not create
a new enterprise
risk automatically.

Part 16 — Executive Risk Summary

Executives should not receive the entire technical worksheet first.

They need:

What Is
the Risk?

Why Does
It Matter?

How Significant
Is It?

What Are
We Doing?

What Decision
Is Required?

Step 26 — Create Executive Summary

Use:

ROLE

Act as an executive
cyber risk reporting
assistant.

INPUT

Use only the
validated enterprise
risk register.

TASK

Prepare a concise
executive risk summary.

Include:

Top Risks

Business Impact

Residual Risk

Risk Trends
if available

Key Control Gaps

Treatment Priorities

Decisions Required

CONSTRAINTS

Do not change
risk ratings.

Do not invent
financial impact.

Do not exaggerate
risk.

Example Executive Summary

CloudNova's most
significant identified
cybersecurity exposures
relate to privileged
access, unresolved
critical vulnerabilities
and production monitoring.

The highest residual
risk concerns privileged
cloud access, where
three administrator
accounts currently
lack enforced MFA.

Additional material
exposure exists from
critical vulnerabilities
that have remained
unresolved beyond
the expected remediation
period.

Management should
prioritize privileged
access remediation,
critical vulnerability
resolution and complete
production security
monitoring coverage.

Part 17 — Create Risk Heatmap Data

Prepare:

Risk_Heatmap.csv

with:

Risk	Likelihood	Impact	Score	Rating
RISK-001	3	5	15	High
RISK-002	3	4	12	High
RISK-003	2	5	10	High

Use only your validated residual ratings.

Part 18 — Challenge the Assessment

A mature GRC analyst challenges their own conclusions.

Ask AI:

Challenge the
current risk assessment.

Identify:

Unsupported Assumptions

Missing Evidence

Possible Overstatement

Possible Understatement

Alternative Scenarios

Controls That May
Have Been Missed

Questions for
Risk Owners

Do not change
the official ratings.

Step 27 — Document Challenge Results

Create:

Risk_Assessment_Review.md

Document:

AI Challenge

Analyst Response

Accepted Change

Rejected Change

Reason

This provides:

Traceability

Part 19 — Final Validation

Before completing the lab, verify every risk.

For each ask:

01 Is the asset real?

02 Is the threat plausible?

03 Is the condition supported?

04 Is the risk event clear?

05 Is business impact plausible?

06 Are controls actually present?

07 Are control limitations documented?

08 Are scores based on methodology?

09 Is residual risk justified?

10 Is the treatment actionable?

11 Is ownership identified or TBD?

12 Did AI invent anything?

Expected Final Risk Register

Your final register should contain approximately:

5–8
Well-Defined
Cybersecurity Risks

Do not create:

50 Generic Risks

Quality is more important than quantity.

Portfolio Deliverables

At the end of this mission, keep:

01 Business_Context.md

02 Asset_Inventory.csv

03 Threat_Register.csv

04 Risk_Conditions.csv

05 Risk_Scenario_Register.csv

06 Control_Register.csv

07 Risk_Assessment_Worksheet.csv

08 Enterprise_Risk_Register.csv

09 Risk_Treatment_Plan.csv

10 Risk_Assessment_Review.md

11 Executive_Risk_Summary.md

12 Risk_Heatmap.csv

Portfolio Structure

Recommended folder:

Lab 01 — AI-Assisted Enterprise Risk Assessment
│
├── 01 Business Context
├── 02 Asset Inventory
├── 03 Threat Register
├── 04 Risk Conditions
├── 05 Risk Scenarios
├── 06 Control Register
├── 07 Risk Assessment
├── 08 Enterprise Risk Register
├── 09 Risk Treatment Plan
├── 10 Assessment Review
├── 11 Executive Summary
└── 12 Risk Heatmap

Mission Success Criteria

You have successfully completed the lab when:

business objectives are documented.
critical assets are identified.
threats are separated from risks.
current control gaps are documented.
at least five structured risk scenarios exist.
inherent risk is assessed.
existing controls are documented.
residual risk is assessed.
treatment options exist.
risk owners are identified or marked TBD.
every material conclusion is traceable to the scenario.
AI assumptions have been challenged.
an executive summary has been produced.

Knowledge Check

Why should business context be understood before identifying risks?
What is the difference between a threat and a risk?
What is the difference between a vulnerability and a risk?
Why is missing MFA not itself a complete risk statement?
What elements make up a strong risk scenario?
Why should AI-generated risks be considered candidate risks?
What is inherent risk?
What is residual risk?
Why does the existence of a control not prove control effectiveness?
What is the purpose of a risk register?
Why should GRC not automatically own every risk?
What are the four common risk treatment approaches?
Why should AI not assign final risk acceptance?
What is risk correlation?
What is a systemic risk theme?
Why should risk assessments be challenged?
Why must assumptions be documented?
Why should risk ratings follow an approved methodology?
Why is executive risk reporting different from analyst reporting?
What role should AI play in enterprise risk assessment?

Key Takeaways

The risk-assessment process is:

Business Context
      ↓
Assets
      ↓
Threats
      ↓
Conditions
      ↓
Risk Scenarios
      ↓
Likelihood
      ↓
Impact
      ↓
Inherent Risk
      ↓
Controls
      ↓
Residual Risk
      ↓
Treatment
      ↓
Monitoring

AI can accelerate:

Risk Discovery

Risk Writing

Data Organization

Control Analysis

Treatment Analysis

Theme Detection

Reporting

But:

AI-Generated Risk
      ≠
Validated Risk

and:

AI Risk Score
      ≠
Risk Owner Decision

and:

Control Exists
      ≠
Control Is Effective

and:

No Evidence
      ≠
No Risk

The professional workflow remains:

AI
Analyzes

      ↓

GRC Analyst
Validates

      ↓

Risk Owner
Evaluates

      ↓

Authorized Authority
Makes the Decision

Career Connection

This lab mirrors activities performed by:

GRC Analysts

Cyber Risk Analysts

Technology Risk Analysts

Cloud Risk Analysts

Security Assurance Analysts

Risk Consultants

GRC Consultants

During an interview, you should be able to explain:

How You
Identified the Risk

Why It Matters

Which Controls
Apply

How You
Assessed It

What Treatment
You Recommended

How AI
Supported the Process

The strongest portfolio outcome is not simply a spreadsheet.

It is demonstrating that you understand:

Business
      ↓
Technology
      ↓
Threat
      ↓
Risk
      ↓
Control
      ↓
Decision

What’s Next?

➡️ Next: Lab 02 — AI-Assisted Policy Review and Gap Analysis

In the next lab, you will move from:

Enterprise
Risk Assessment

to:

Enterprise
Policy Governance

You will receive a fictional security policy and use AI to:

Extract Requirements

Review Policy Structure

Identify Ambiguous Language

Identify Missing Requirements

Perform Gap Analysis

Map Requirements
to Controls

Draft Improvements

Validate AI Recommendations

Your final portfolio artifacts will include:

Policy Review Report

Requirement Register

Policy Gap Register

Policy-to-Control Mapping

Updated Policy Draft

➡️ Next: Lab 02 — AI-Assisted Policy Review and Gap Analysis