CISSP Cyber Training Podcast - CISSP Training Program · Shon Gerber, vCISO, CISSP, Cybersecurity Consultant and Entrepreneur

CCT 316: CrowdStrike, Signal, And Identify, Analyze, and Prioritize Business Continuity (CISSP Domain 1.8) - Part 2

·29 min·1 clip

Risk treatment options include mitigate, transfer, accept, and avoid.

Sean Gerber starts with his usual welcome and sets up part two of Domain 1.8 because the previous section ran long. He points to a CSO Magazine article about CrowdStrike and Signal and uses it as a live example of how a security company can keep growing and shifting the market. Then he pivots into the CISSP material. The main focus is the business impact analysis and the risk thinking that sits underneath it. He breaks down the standard risk treatment options: mitigate, transfer, accept, and avoid. He keeps the examples simple on purpose. Insurance becomes a way to think about transfer, while rubber boots, rubber gloves, and shutting off power illustrate mitigation. Acceptance is framed as choosing to live with a risk when there is no better practical move. Avoidance is the decision not to do something at all because of the risk attached to it. He ties all of that back to business impact analysis. The point is that these decisions are not abstract test words, they are the same kind of judgment calls people make every day. He also emphasizes that risk acceptance is a management decision. A security professional can recommend, but cannot personally declare the risk accepted unless they are the decision-maker for the company. He stresses that acceptance must be documented. He then moves into impact analysis. Quantitative impact is the side you can count, like lost revenue per day or hour, or regulatory fines. Qualitative impact is the harder-to-measure side, where the harm is real but not easily reduced to a number. The whole segment keeps translating technical wording into business language. That is the point of the episode. The style stays conversational and direct, with Sean repeating key ideas so listeners can hear them in more than one way. He frames the material around what a practitioner would actually say to leadership. He keeps the pacing steady and instructional. By the end, the episode lands on the familiar CISSP message that understanding the concept matters more than memorizing the phrase.

As heard by us

A practical CISSP walkthrough that keeps risk decisions tied to real-world examples.

Sean Gerber turns Domain 1.8 into a grounded lesson on risk treatment and impact analysis, opening with CrowdStrike and Signal before settling into the exam language that matters.

Read the full review in PlayNext →

Why you'd press play

Want BIA and risk treatment explained in CISSP terms you can use in real decisions?

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from CISSP Cyber Training Podcast - CISSP Training Program