{
  "id": "workflow:cyber-risk-quantification",
  "_kind": "Workflow",
  "_file": "workflows/workflows/workflows-grc.yaml",
  "_cluster": "workflows",
  "attributes": {
    "displayName": "Cyber Risk Quantification",
    "workflowKind": "governance",
    "triggerType": "scheduled",
    "typicalCadence": "quarterly",
    "complexity": "cross-team",
    "description": "Quantifies cybersecurity risk in financial terms -- applying FAIR\n(Factor Analysis of Information Risk) methodology to model loss event\nfrequency and magnitude scenarios, aggregating threat intelligence feeds\nto calibrate threat event frequency estimates, incorporating\nvulnerability scan results and penetration test findings into loss\nscenario inputs, running Monte Carlo simulations to generate annualized\nloss expectancy distributions, and presenting risk-adjusted ROI analyses\nfor proposed security investments to executive stakeholders. Produces\ncyber risk quantification reports, loss exceedance curves, and security\ninvestment prioritization matrices. Excludes security control\nimplementation.\n"
  },
  "outgoingEdges": [
    {
      "from": "workflow:cyber-risk-quantification",
      "to": "role:security-reviewer",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-quantification",
      "to": "role:data-scientist",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-quantification",
      "to": "role:engineering-manager",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-quantification",
      "to": "skill-area:python-data-pipelines",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-quantification",
      "to": "skill-area:incident-response",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-quantification",
      "to": "domain:cybersecurity-grc",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-quantification",
      "to": "domain:security",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-quantification",
      "to": "responsibility:threat-modeling",
      "kind": "triggers_responsibility",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-quantification",
      "to": "responsibility:cost-optimization",
      "kind": "triggers_responsibility",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-quantification",
      "to": "org-unit:security-team",
      "kind": "performed_by_org_unit",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-quantification",
      "to": "org-unit:risk-management-team",
      "kind": "performed_by_org_unit",
      "attributes": {}
    }
  ],
  "incomingEdges": []
}