security-risk-analyst

Inherent risk scoring evaluates threat and vulnerability exposure before controls are applied, while residual risk scoring measures remaining exposure after controls. TVC mapping links these threats, vulnerabilities, and controls to justify the risk treatment decisions.

You generate executive risk narratives and KRIs by summarizing scenario-based risk registers, residual scores, and treatment statuses. This translates technical TVC mapping and gap analysis into board-ready governance reporting and committee briefing materials.

Yes, you can use this for third-party risk assessment. It supports supply-chain risk evaluation by framing questionnaire scopes and tiering vendors, which integrates external threats into your inherent and residual risk scoring workflows.

The best way to map threats, vulnerabilities, and controls is through structured TVC mapping. This identifies control gaps, tracks evidence, and calculates residual risk scores to inform risk treatment planning and acceptance decisions.