# Cross-Functional Risk Translation Workshop

- **PURPOSE:** Provides a structured approach for bringing together technical and business stakeholders to collectively translate technical vulnerabilities into business impact terms.
- **WHEN TO USE:**When preparing for major security investment decisions, developing risk registers, or establishing shared understanding of security priorities.

## WORKSHOP PREPARATION

**Duration**2-3 hours

### Participants:

1. Security/IT Team (who understand technical vulnerabilities)
2. Business Unit Leaders (who understand business processes)
3. Finance Representative (who can assist with impact quantification)
4. Risk Management (who can ensure alignment with enterprise risk)
5. Facilitator (ideally someone with both technical and business understanding)

### Pre-workshop Materials to Distribute:

- [ ] Current vulnerability reports (sanitized for clarity)
- [ ] Business process maps showing critical functions
- [ ] Previous incident data and costs (if available)
- [ ] Workshop templates (vulnerability-to-business impact worksheet)

### Room Setup:

- Main room for plenary sessions
- Breakout spaces for small group work (if possible)
- Whiteboards/flipcharts for visualization
- Projection for shared viewing of documents

## WORKSHOP STRUCTURE

### 1. INTRODUCTION (20 minutes)

- Welcome and introductions
- Workshop purpose and expected outcomes
- Ground rules (focus on business impact, not blame)
- Brief explanation of risk translation concept

### 2. ESTABLISH COMMON UNDERSTANDING (30 minutes)

- Security team: Present top 3-5 current technical vulnerabilities in plain language
- Business team: Explain critical business functions and time sensitivities
- Finance: Share framework for calculating business impacts
- Group discussion to clarify questions

### 3. SMALL GROUP TRANSLATION EXERCISE (60 minutes)

- Form mixed teams (technical and business representatives)
- Each team selects 1-2 vulnerabilities to analyze
- Using the worksheet provided, teams:
- Identify which business functions would be affected
- Estimate potential disruption timeframes
- Brainstorm potential business consequences
- Quantify impacts where possible
- Document assumptions and uncertainties

### 4. PLENARY SHARING AND SYNTHESIS (40 minutes)

- Each group presents their analysis
- Facilitate discussion on findings
- Identify common patterns and insights
- Agree on relative priority of vulnerabilities based on business impact

### 5. ACTION PLANNING (30 minutes)

- Document agreed business impact translations
- Assign follow-up tasks for further investigation/validation
- Agree on how translated risks will inform prioritization
- Set timeline for implementation of recommendations

## POST-WORKSHOP ACTIVITIES

- Document and distribute translations and prioritization decisions
- Update risk register with business impact information
- Schedule follow-up meeting to review progress
- Integrate findings into security roadmap and budget planning

## IMPLEMENTATION TIPS: 

- Prepare business-friendly descriptions of technical vulnerabilities before the workshop to save time and avoid jargon barriers
- Select a diverse mix of participants who can represent different perspectives within the organization
- Use real examples from your environment rather than hypothetical scenarios to make the exercise more relevant and actionable

***

(c)[Kayne McGladrey](https://kaynemcgladrey.com/) - [Get the full book "Cyber Risk is a Myth"](https://www.routledge.com/Cyber-Risk-is-a-Myth-A-Business-Approach-to-Integrated-Risk-Management/McGladrey/p/book/9781041249054)