Running change risk scoring at Pennington Mutual on an eight-tread staircase from purpose and anatomy through calibration, classes, emergency, automation and drift to evidence: change CHG-88214 scored 34 and reached production without a security review, so the score becomes a routing decision; 412 changes a month split into 288 standard, 106 normal and 18 emergency; calibration against nine past incidents lifts the catch rate from 3 of 9 to 8 of 9; and a drift monitor shows the median score falling from 46 to 31 over 14 months.

CY-EXPERT-065Expert Level · Security Operations

Change Risk Scoring and Defensibility

An expert-level course on how a change management function scores the security risk of a change so that the score is consistent, evidenced, and still defensible a year later in front of an auditor, a regulator or a post-incident review. Climb the staircase - eight treads carrying a change from raised to post-implementation review: establishing what a score is actually for; building factors, weights and thresholds that survive challenge; calibrating against changes that already happened; defining the standard, normal and emergency classes; scoring the emergency after the fact; deciding where automated scoring is defensible; detecting and correcting score drift; and writing an approval record somebody can reconstruct a year later.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Explain what a change risk score is for, and bind every band of a scale to the review, signatories, evidence and turnaround it obliges.
Select scoring factors observable from the change record before deployment, derive weights from outcome frequency, external obligation or a recorded decision, and place thresholds with their boundary rules written in advance.
Calibrate a model against the organisation's own history including every incident-causing change, using blinded retrospective scoring, and set thresholds from hit rate against review burden as a recorded appetite decision.
Define standard, normal and emergency change classes by the decision each removes, give every standard-change catalogue entry a security position and an expiry, and place security review inside the flow as a blocking transition.

Price:৳12,000