Overview
Governance, Risk, and Compliance framework for enterprise risk assessment and management. Risk scoring, control mapping, asset inventory, vulnerability correlation, and executive risk dashboards for board-level reporting.
Environment & Scope
Lab Setup
Python 3.9+ | Flask | PostgreSQL | Ubuntu 20.04 LTS | 2GB RAM
Scope
- • Asset inventory (systems, data, infrastructure) • Vulnerability catalog with severity scoring • Risk calculation (likelihood × impact) • Risk appetite thresholds • Control effectiveness assessment • Risk heat maps for executive dashboards • Remediation prioritization
Methodology
- 1. Asset discovery and cataloging 2. Threat identification per asset 3. Vulnerability assessment and scoring 4. Control identification and mapping 5. Risk calculation (raw risk, residual risk post-control) 6. Risk prioritization matrix 7. Remediation plan creation 8. Re-assessment on schedule or after changes
Key Findings
• 47 critical/high-risk items identified (33 system risks, 14 process gaps) • Top risk: unencrypted database with PII (likelihood: high, impact: critical) → Risk score: 9.5/10 • Control coverage: 78% of risks have mitigation (22% uncontrolled) • Estimated annual risk exposure: $2.3M (if materialized)
Business Impact
Unmanaged risks lead to security incidents, regulatory penalties, and operational disruptions. This framework makes risk visible to leadership and enables prioritized investment.
Remediation & Improvements
- Priority 1: Database encryption (60 days) Priority 2: Access control hardening (90 days) Priority 3: Network segmentation (120 days) Estimated total cost: $150K | Timeline: 6 months
Lessons Learned
- 1. Risk is not technical — it's business impact; quantify it 2. Controls multiply across frameworks; reuse assessments 3. Risk dashboards change executive behavior (they fund fixes)
Technologies
Tools & Platforms: Python | Flask | PostgreSQL | Vulnerability databases (CVE, NVD)
Hiring Relevance: Equity Bank Risk Manager, GRC Program Lead, Enterprise Risk Officer
View on GitHub
Full implementation, README, and deployment instructions available at:
GitHub Repository →