Cybersecurity risk calculation and reporting model

Abstract

A cybersecurity risk reporting methodology for a bank's computer systems which includes a cybersecurity risk level calculation model. For each of the bank's organizational groups, the model is run on a periodic basis to calculate the cybersecurity risk level. Inputs to the calculation model include cybersecurity vulnerabilities and severities for each of the organizational group's applications and systems, along with a cybersecurity history rating for the group. The model calculates a cybersecurity risk level which is reported to the organizational group, along with an indication of whether the group's risk level exceeds a threshold which freezes the group's ability to implement feature-based application/system upgrades. Proposed security-related fixes may be provided as inputs to the model, which calculates a predicted cybersecurity risk level for the organizational group, allowing the group to identify what security fixes need to be implemented in order to lower the group's cybersecurity risk level below a threshold.