Formación en evaluación de riesgos y vulnerabilidades de ciberseguridad en Moscú

Descripción del programa

Ministries, regulators, utilities, banks and project implementation units now run core services on digital platforms: tax portals, payment systems, grid control, health records and digital identity. Each new platform adds assets, suppliers and connections that have to be understood before they can be protected. A structured risk and vulnerability assessment (RVA) is how an institution finds out what it owns, where it is exposed and which weaknesses deserve money and attention first.

The reference frameworks have changed in the last three years. NIST released version 2.0 of its Cybersecurity Framework in February 2024, adding a sixth function, Govern, that places cyber risk with senior leadership rather than the IT team alone. ISO/IEC 27001 and its risk management companion ISO/IEC 27005 were both revised in 2022, and FIRST published version 4.0 of the Common Vulnerability Scoring System (CVSS) on 1 November 2023, with new ways of expressing threat and environmental context.

Development finance has also moved. The World Bank set up a Cybersecurity Multi-Donor Trust Fund under its Digital Development Partnership, supported by Estonia, Germany, Japan and the Netherlands, to fund country assessments, technical assistance and training. Digital transformation projects such as the World Bank-supported Ghana Digital Acceleration Project and the PATNuC digital transformation project in Cameroon include work on national incident response and on assessing and managing cyber risk to digital infrastructure.

This five-day programme in Moscow is written for the managers, risk owners and technical leads who commission, run and act on assessments. It is defensive and management-focused: participants learn how to scope an assessment, read and prioritise findings, choose controls, report risk to decision-makers and build a repeatable cycle. It does not teach offensive or exploit techniques.

Participants work with current versions of the main standards and compare how countries, including the host country, regulate critical information infrastructure.

El programa fortalece la capacidad institucional en

• Cyber risk governance and board-level accountability
• Critical service and critical information infrastructure identification
• Threat identification using public intelligence sources
• Scoping and authorising vulnerability assessments
• Interpreting vulnerability scan reports
• Vulnerability prioritisation with CVSS v4.0 and exploitation evidence
• Risk registers and risk matrices
• Risk appetite and tolerance statements
• Control selection against ISO/IEC 27001:2022 Annex A
• Patch and configuration management governance
• Third-party and supply chain cyber risk
• Business continuity and recovery priorities
• Regulatory and donor compliance reporting
• Cyber risk metrics and key performance indicators
• Communicating cyber risk to non-technical leaders
• Continuous improvement of the assessment cycle

Each topic is taught through documents participants will use at work.

The Growing Importance of Cyber Risk and Vulnerability Assessment

ITU’s Global Cybersecurity Index 2024 shows how quickly national capability has grown and where the gaps remain. ITU reports that 139 countries now have active computer incident response teams, up from 109 in 2021, and 132 have a national cybersecurity strategy. The same report finds that the capacity development and technical pillars are still relatively weak in most countries, with gaps in skills, staffing, equipment and funding across every region.

The threat picture keeps assessments busy. ENISA’s Threat Landscape 2025 analysed 4,875 incidents in the year to June 2025 and describes groups that reuse tools, exploit known vulnerabilities and target public administration. CISA’s Known Exploited Vulnerabilities catalogue, created under Binding Operational Directive 22-01 in November 2021, exists because many breaches use weaknesses that were already public and patchable. For managers, the lesson is simple: assessment only has value when it leads to a ranked list of actions that someone owns.

Regulation is tightening at the same time. Many countries now require operators of critical information infrastructure to categorise their systems, assess risk and report incidents to a national authority. Russia’s Federal Law No. 187-FZ of 26 July 2017 is one example, and amendments that took effect in 2025 and 2026 extended the obligations.

Las organizaciones necesitan cada vez más profesionales capaces de:

• Defining the scope and boundaries of an assessment
• Identifying which services and systems are critical
• Using threat intelligence to judge likelihood
• Commissioning authorised vulnerability scans and reviewing results
• Separating vulnerability assessment from penetration testing
• Scoring vulnerabilities with CVSS v4.0 and adding local context
• Prioritising known exploited vulnerabilities
• Running qualitative and semi-quantitative risk analysis
• Choosing between treating, transferring, avoiding and accepting risk
• Assessing supplier and cloud service risk
• Reporting cyber risk in plain language to leadership

Strong cyber risk systems help organisations:

• Spend limited security budgets where risk is highest
• Reduce the window between disclosure and patching
• Meet national critical infrastructure obligations
• Satisfy financier and auditor requirements on digital projects
• Protect citizen data and service continuity
• Recover faster after an incident
• Hold suppliers to clear security expectations
• Show measurable progress to boards and ministries

The programme treats RVA as a management cycle rather than a one-off audit. Participants leave with a method they can repeat each quarter.

Who Should Attend This Cyber Risk and Vulnerability Assessment Training?

Este programa está dirigido a:

• Chief information security officers and their deputies
• Heads of IT and digital transformation units
• Information security managers and analysts
• Enterprise and operational risk managers
• Internal auditors covering IT and information security
• Compliance officers and data protection officers
• Security operations centre leads
• System and network administration supervisors
• Business continuity and disaster recovery managers
• Officials of national CERTs and cybersecurity agencies
• Regulators supervising critical information infrastructure
• Digital project coordinators in donor-funded PIUs
• Energy, telecom, water and transport operators’ IT managers
• Bank and payment system technology risk staff

Teams are encouraged to send a technical lead and a risk or audit counterpart together, so that both sides of the assessment cycle are represented.

Cyber Risk and Vulnerability Assessment Training Objectives

Upon successful completion of this Cyber Risk and Vulnerability Assessment Training, participants will be able to:

• Explain risk, threat, vulnerability, likelihood and impact using consistent definitions
• Apply the six functions of NIST CSF 2.0, including Govern, to their institution
• Plan a risk assessment using the NIST SP 800-30 Rev. 1 process
• Align assessment practice with ISO/IEC 27001:2022 and ISO/IEC 27005:2022
• Scope, authorise and supervise vulnerability assessments
• Interpret scan reports and remove false positives with system owners
• Prioritise vulnerabilities using CVSS v4.0 and exploitation evidence
• Build and maintain a cyber risk register with clear owners
• Select administrative and technical controls in proportion to risk
• Link assessment findings to incident response and continuity plans
• Map assessment outputs to national and sector regulatory requirements
• Design metrics that show whether risk is falling

Each objective is practised in a workshop on a realistic case.

Contenido y estructura del programa

Cyber Risk and Vulnerability Assessment Training Methodology

The programme is built around decisions that managers make: what to assess, what to fix first, what to accept and how to report. Sessions are short, followed by practical work on templates participants can take home.

El programa combina:

• Short expert briefings on current frameworks and standards
• Facilitated discussion of real financed digital projects
• Group workshops using anonymised scan and risk data
• Risk register and prioritisation exercises
• Scenario-based incident and continuity discussions
• Comparative review of national CII regulation
• Peer exchange between technical and risk staff
• Template-based drafting of scope notes and memos
• Leadership briefing practice with panel feedback
• Autoevaluación previa al curso y planes de acción posteriores

All practical work is defensive and uses prepared material; no live systems are tested. Institutions can measure their starting point beforehand with Risalat’s free digital readiness assessment.

Resultados esperados

Upon completion of this Cyber Risk and Vulnerability Assessment Training, participants will be able to:

• Lead or commission a risk assessment with a clear scope and authorisation
• Turn vulnerability findings into a ranked, owned action list
• Maintain a cyber risk register aligned with ISO/IEC 27005:2022
• Use CVSS v4.0 and exploitation evidence to set remediation deadlines
• Present cyber risk to senior leaders in plain language
• Write defensible risk acceptance decisions
• Link assessment results to incident response and continuity plans
• Track progress through practical cyber risk metrics
• Plan a repeatable twelve-month assessment cycle

Leaders gain a clearer view of exposure and technical teams a stronger case for resources.

Institutional Application of Cyber Risk and Vulnerability Assessment Training

Este programa ayuda a las organizaciones a fortalecer:

• Cyber risk governance and leadership oversight
• Asset and service inventories
• Assessment scoping and authorisation procedures
• Vulnerability management and patch governance
• Risk registers and risk appetite statements
• Control frameworks aligned with ISO/IEC 27001:2022
• Supplier and cloud security management
• Incident response and continuity planning
• Regulatory and financier compliance
• Cyber risk reporting and metrics

Los participantes regresan con herramientas prácticas para mejorar:

• Assessment scope notes
• Asset and critical service registers
• Vulnerability prioritisation sheets
• Cyber risk registers
• Risk acceptance memos
• Remediation trackers
• Leadership briefing templates
• Twelve-month assessment plans

Institutions that want to check how cyber risk sits within wider governance arrangements can also use Risalat’s governance audit diagnostic.

Pertinencia y aplicación regionales

Europa

ENISA’s Threat Landscape 2025 covers 4,875 incidents between July 2024 and June 2025 and points to sustained pressure on public administrations, including hacktivist DDoS campaigns. European participants can use the programme to connect formal risk assessments with the threats their sector actually faces.

África

ITU reports that Africa has advanced the most of any region since 2021, yet skills and funding gaps remain. Projects such as the World Bank-supported Ghana Digital Acceleration Project, whose 2025 mission included the national CERT, and the PATNuC programme in Cameroon, which sought expertise on assessing cyber risk to digital infrastructure, show the demand for officials who can run assessments and act on them.

Oriente Medio

Governments across the region are expanding digital government and payment platforms, and national authorities set controls for critical sectors. The comparative sessions help participants map these controls to ISO and NIST references.

Asia

Asian countries range from Tier 1 performers in the ITU index to those still building a national CERT; the methods suit both.

Central Asia and the CIS

Many CIS countries share regulatory traditions on critical information infrastructure with the host country, while also aligning with international standards. Holding the programme in Moscow lets participants compare categorisation, reporting and supplier rules directly.

América Latina

Public bodies across Latin America are expanding digital services while national strategies and incident response teams are still maturing. The programme helps them turn strategy commitments into regular, budgeted assessment work.

Across all regions the common need is the same: a repeatable method that turns technical findings into decisions leaders can fund and defend.

Host Country Profile – Russia

Moscow is Russia’s capital and its largest administrative, financial and technology centre, with major universities, banks, telecom operators and public digital service providers. It is a convenient meeting point for participants from the CIS, Central Asia and partner countries that keep regular air links with Russia.

Russia offers a detailed example of a national regime for critical information infrastructure. Federal Law No. 187-FZ of 26 July 2017 requires CII entities in sectors such as energy, finance, transport, telecoms and health to form categorisation commissions, assign significance categories to their systems and report the results to the Federal Service for Technical and Export Control (FSTEC). Amendments in force from 1 September 2025 require continuous interaction with the state system for detecting and responding to computer attacks (GosSOPKA), and sector rules for financial market categorisation followed in February 2026. The programme presents this model factually, alongside NIST and ISO approaches, so participants can compare design choices.

Russia introduced a unified electronic visa on 1 August 2023 for citizens of an approved list of countries; others apply through a Russian consulate. Entry rules, payment arrangements and travel advice change, and several governments currently advise against travel to Russia. Participants should check the latest official entry requirements and their own government’s travel advice before registering, and Risalat’s visa advisory team will confirm the current position for each nationality.

Cyber Risk and Vulnerability Assessment Training Deliverables

Every participant receives a complete package before, during and after the programme so the learning carries back into the institution.

Antes del programa

• Evaluación previa del participante
• Cyber Risk Management Readiness Assessment
• Cyber Risk and Vulnerability Assessment Resource Pack
• Materiales de lectura preparatoria
• Apoyo y asesoramiento gratuitos para el visado
• Recogida en el aeropuerto y asistencia de bienvenida
• Alojamiento con desayuno
• Cena de bienvenida y networking

Durante el programa

• Kit de formación de Risalat (bolsa, botella, taza, camiseta, gorra, funda de pasaporte, bolígrafos, cuaderno, imán y llavero)
• Comprehensive Cyber Risk and Vulnerability Assessment Training Manual
• Assessment Scope Note Template
• Asset and Critical Service Register Template
• CVSS v4.0 Prioritisation Worksheet
• Cyber Risk Register Template
• Risk Acceptance Memo Template
• Remediation Tracker
• Leadership Briefing Template
• Talleres prácticos y simulaciones
• Debates en grupo y aprendizaje entre pares
• Almuerzo y refrigerios diarios
• Acceso completo a las instalaciones de la sede de formación
• Mini Pad / tableta con materiales didácticos digitales
• Visita de campo (cuando proceda)
• Recorrido turístico por la ciudad

Después del programa

• Certificado de finalización
• Reconocimiento a la participación en programas de Risalat
• Materiales de consulta posteriores a la formación
• Twelve-Month Assessment Plan Template
• Framework Reference Sheet (NIST CSF 2.0, SP 800-30, ISO/IEC 27005)
• Cyber Risk Metrics Starter Set
• Apoyo posterior a la formación y orientación de seguimiento
• Informe del programa

Institutions that want the programme adapted to their own systems, regulator and project portfolio can request a tailored in-house version through our request a proposal form. A short training needs assessment helps us match the content to each team.

Common Challenges in Cyber Risk and Vulnerability Assessment, And How This Training Helps

How can we assess risk when our asset inventory is incomplete?

Day 2 starts with a practical inventory method that begins from critical services and works down to systems, data and suppliers, so teams can assess the most important areas first while the full inventory is built.

How do we decide which of hundreds of scan findings to fix first?

Day 3 shows how to combine CVSS v4.0 scores, evidence of active exploitation from sources such as the CISA Known Exploited Vulnerabilities catalogue and business impact into a short ranked list with deadlines.

How can we get senior leaders to engage with cyber risk?

Day 1 applies the Govern function of NIST CSF 2.0 to clarify accountability, and the Day 5 capstone gives participants practice briefing a leadership panel in plain language.

How should we record a decision to accept a risk?

Day 4 provides a risk acceptance memo template with owner, rationale, compensating controls and review date, tested on a realistic case.

How can assessment results improve incident response?

Day 4 links the highest risks to response playbooks and continuity priorities, then tests them against a short scenario.

How do we meet national CII rules and international standards at the same time?

Day 5 compares national regulation models, including Russia’s 187-FZ, with ISO/IEC 27001:2022 and NIST CSF 2.0 so teams can map one set of evidence to several requirements.

How can we show that cyber risk is actually reducing?

Day 5 introduces a starter set of metrics, such as time to remediate critical findings and coverage of the asset inventory, and builds them into a twelve-month plan.

Preguntas frecuentes

Is this a hacking or penetration testing course?

No. The programme is defensive and management-focused. It covers how to scope, commission, interpret and act on assessments; no live systems are tested and no exploit techniques are taught.

Which frameworks are covered?

NIST Cybersecurity Framework 2.0 (February 2024), NIST SP 800-30 Rev. 1, ISO/IEC 27001:2022, ISO/IEC 27005:2022 and CVSS v4.0, with public sources such as the CISA Known Exploited Vulnerabilities catalogue.

Do participants need a technical background?

Basic familiarity with IT systems helps, but the programme is designed for both technical leads and risk, audit and compliance staff. Mixed teams gain the most.

¿Qué se llevarán los participantes a casa?

Templates for scope notes, asset registers, CVSS v4.0 prioritisation, risk registers, risk acceptance memos, remediation tracking and leadership briefings, plus a draft twelve-month assessment plan.

What should international participants know about travel to Moscow?

Russia offers a unified e-visa to citizens of listed countries; others apply through a consulate. Rules and travel advice change, so check official entry requirements and your own government's advice before registering. Risalat's visa team will help.

¿Puede impartirse el programa de forma interna?

Yes. Institutions can request a tailored version built around their own systems, regulator and project portfolio through Risalat's request a proposal form.

All programmes in MoscowMás programas de gestión de la seguridad

More training courses in Russia · Calendario completo de formación