Fireproof Your Castle with Risk-First GRC
summary
Argues a shift to risk-first GRC that starts by listing business assets and failure scenarios, then uses qualitative triage plus Monte Carlo CRQ (FAIR logic) for focused questions. Recommends six-point anchors (min/likely/max for likelihood and impact), shows an example where a deletion scenario yields 46% chance, $3–9M loss and demonstrates how access controls drop occurrence to ~25% or reduce impact to ~$1.2–4.2M, and promotes principle-based compliance.
AI-written summary · about
chapters (15)
- 0:00Introduction and welcome
- 1:03About the speakers and disclaimer
- 2:32Risk versus GRC and org structure
- 6:30Castle analogy and threat landscape
- 7:10Traditional compliance-driven GRC
- 8:35Risk-first GRC approach
- 11:03Qualitative vs quantitative risk assessment
- 15:41Cyber risk quantification explained
- 17:29Hybrid risk assessment strategy
- 23:06Compliance role in security strategy
- 25:12Decision support for leadership
- 26:16Q&A: Leading with risk or compliance
- 27:19Q&A: GRC collaboration with teams
- 28:21Q&A: Estimating risk scenarios
- 29:02Q&A: CRQ in third-party risk
related talks
38mHow to Be a GRC Hero (Without Heroics)
36mNot Your Mama's Risk Assessment
47mTechniques to Evolve Risk Governance and Comply with SEC Cybersecurity Rule
51mFAIR STRIDE - Building Business Relevant Threat Models
34mRapid Risk Assessment: A Lightweight Approach
15mCyber Risk Management: let’s try to manage it with open source and free software
27mFlipping the Criticality Funnel, A Practical Path to Real Prioritization
31m📗 Rehearsal is Over: Moving GRC Engineering from Theory into Practice ⚖️