Asset Identification, Risk Assessment and Practical Design of Security Measures

The workshop focuses on a practical approach to managing assets, risks, and security measures in accordance with the Cybersecurity Act and related requirements for risk analysis, security documentation, and audits. Participants will work with a fictional organization and go through the entire process: from asset identification, impact analysis, and information classification to determining ICT risks, designing appropriate security measures, and formulating basic audit findings.

Emphasis is placed on real, practical exercises. Each block is structured as a workshop activity in which participants work in groups and jointly create an asset catalogue, impact and criticality matrices, information classification, a risk register, and an action plan. The fictional company is designed to reflect a typical environment of Slovak organizations, combining internal IT, cloud services, and suppliers, including the perspective of third parties and their influence on the organization’s cybersecurity posture. Each exercise concludes with an evaluation and discussion of what the groups did and why.

A significant part of the workshop is dedicated to demonstrating how the outputs – asset lists, impact analysis, classification, risks, and measures – form the foundation of security documentation and later become part of cybersecurity audits. In the final exercise, participants take on the role of auditors and prepare several model audit findings for “their” fictional company in order to understand how cybersecurity audits and internal controls view the entire process.