Risk & Cybersecurity
JPMorgan Chase — Firmwide Cyber Risk Taxonomy
Board-ready cyber risk taxonomy spanning five major risk categories with qualitative and quantitative residual-risk assessment.
Role: Author / analyst (course client engagement framing)
Context
Large financial institutions need a shared language for cyber risk that connects technical threat frameworks to enterprise risk, residual risk, and board oversight- not tool-centric checklists alone.
Method / approach
Developed a cyber risk taxonomy using MITRE ATT&CK, ISO 27001, and NIST across five major risk categories. Applied qualitative and quantitative risk assessment to evaluate likelihood, impact, and residual risk, incorporating zero trust, multi-cloud resilience, AI-enabled defenses, and post-quantum planning.
Tools and technologies
- MITRE ATT&CK
- ISO 27001
- NIST
- Qualitative & quantitative risk assessment
Key deliverables
- 57-page firmwide cyber risk taxonomy report
- Category structure and residual-risk framing
Results / findings
- Produced a structured taxonomy document suitable for board- and enterprise-risk style communication.