A—ORGANIZATIONAL GOVERNANCE 

• Organizational Strategy, Goals, and Objectives 
• Organizational Structure, Roles and Responsibilities 
• Organizational Culture 
• Policies and Standards 
• Business Processes 
• Organizational Assets 

B—RISK GOVERNANCE 

• Enterprise Risk Management and Risk Management Framework 
• Three Lines of Defense 
• Risk Profile 
• Risk Appetite and Risk Tolerance 
• Legal, Regulatory and Contractual Requirements 
• Professional Ethics of Risk Management 

A—IT RISK IDENTIFICATION 

• Risk Events (e.g., contributing conditions, loss result) 
• Threat Modelling and Threat Landscape 
• Vulnerability and Control Deficiency Analysis (e.g., root cause analysis) 
• Risk Scenario Development 

B—IT RISK ANALYSIS AND EVALUATION 

• Risk Assessment Concepts, Standards and Frameworks 
• Risk Register 
• Risk Analysis Methodologies 
• Business Impact Analysis 
• Inherent and Residual Risk 

A—RISK RESPONSE 

• Risk Treatment / Risk Response Options 
• Risk and Control Ownership 
• Third-Party Risk Management 
• Issue, Finding and Exception Management 
• Management of Emerging Risk 

B—CONTROL DESIGN AND IMPLEMENTATION 

• Control Types, Standards and Frameworks 
• Control Design, Selection and Analysis 
• Control Implementation 
• Control Testing and Effectiveness Evaluation 

C—RISK MONITORING AND REPORTING 

• Risk Treatment Plans 
• Data Collection, Aggregation, Analysis and Validation 
• Risk and Control Monitoring Techniques 
• Risk and Control Reporting Techniques (heatmap, scorecards, dashboards) 
• Key Performance Indicators 
• Key Risk Indicators (KRIs) 
• Key Control Indicators (KCIs) 

A—INFORMATION TECHNOLOGY PRINCIPLES 

• Enterprise Architecture 
• IT Operations Management (e.g., change management, IT assets, problems, incidents) 
• Project Management 
• Disaster Recovery Management (DRM) 
• Data Lifecycle Management 
• System Development Life Cycle (SDLC) 
• Emerging Technologies 

B—INFORMATION SECURITY PRINCIPLES 

• Information Security Concepts, Frameworks and Standards 
• Information Security Awareness Training 
• Business Continuity Management 
• Data Privacy and Data Protection Principles