Kevin Leverett

This risk assessment methodology demonstrates how I identify, evaluate, and prioritize security risk across an organization's assets — mapping technical findings to business impact so leadership can make informed, defensible decisions about where to invest limited resources.

Built for:

• Demonstrating a repeatable risk assessment process aligned to recognized frameworks
• Showing how raw vulnerability data becomes prioritized, business-context risk
• Supporting security program planning, audit readiness, and compliance efforts

‍

Methodology

The assessment follows a structured, NIST-aligned lifecycle:

• Scoping & Asset Identification — Define assessment boundaries, catalog in-scope systems and data, and assign value and criticality to each asset.
• Threat Identification — Identify relevant threat sources and events across adversarial, accidental, and environmental categories.
• Vulnerability Identification — Map weaknesses that threats could exploit, drawing on scan data, configuration reviews, and stakeholder interviews.
• Likelihood Determination — Assess the probability of exploitation based on threat capability, intent, and the strength of existing controls.
• Impact Analysis — Evaluate consequences to confidentiality, integrity, and availability, as well as to business operations and reputation.
• Risk Determination & Prioritization — Combine likelihood and impact into qualitative risk ratings, then rank findings so the highest-severity risks are addressed first.
• Control Recommendations — Pair each prioritized risk with actionable, cost-aware mitigation guidance.

‍

Frameworks & Standards Applied

• NIST SP 800-30 — Guide for Conducting Risk Assessments
• NIST SP 800-37 — Risk Management Framework (RMF)
• NIST Cybersecurity Framework (CSF) — control and outcome alignment

‍

Skills demonstrated: risk analysis and qualitative risk scoring, NIST framework alignment, control gap analysis, and the ability to translate technical detail into executive-ready risk language.

The attached report applies this methodology end-to-end as a working sample of the deliverable.