Risk & Cybersecurity
JPMorgan Chase — Firmwide Cyber Risk Taxonomy
Board-ready cyber risk taxonomy spanning five major risk categories with qualitative and quantitative residual-risk assessment.
Role: Author / analyst (course client engagement framing)
Situation
Large financial institutions need a shared language for cyber risk that connects technical threat frameworks to enterprise risk, residual risk, and board oversight- not tool-centric checklists alone.
Decision question
How should a global bank talk about cyber risk in a language that connects MITRE/NIST/ISO methods to residual risk and board oversight?
Data and constraints
Framework synthesis rather than a live production dataset; residual-risk judgments are qualitative/quantitative assessments documented in the report.
Method
Developed a cyber risk taxonomy using MITRE ATT&CK, ISO 27001, and NIST across five major risk categories. Applied qualitative and quantitative risk assessment to evaluate likelihood, impact, and residual risk, incorporating zero trust, multi-cloud resilience, AI-enabled defenses, and post-quantum planning.
Tools
- MITRE ATT&CK
- ISO 27001
- NIST
- Qualitative & quantitative risk assessment
Deliverables
- 57-page firmwide cyber risk taxonomy report
- Category structure and residual-risk framing
Outcome / decision value
- Produced a structured taxonomy document suitable for board- and enterprise-risk style communication.
Lessons learned
- Shared taxonomy matters more than tool lists when residual risk has to travel to a board.
- Zero trust, multi-cloud, and post-quantum planning belong in the same conversation as likelihood and impact.