ZRA.com: Risk Assessment and Mitigation

Threat & TTP Assessments

ZRA offers a structured methodology for evaluating risks by considering attacker tactics, techniques, and procedures (TTPs) within the Federal Civilian Executive Branch (FCEB) IT and stakeholder communities. Our analysis considers threat actor origins and threat surfaces, such as attacks across the adversarial tactics, techniques, and common knowledge (ATT&CK) framework and clients IT processes. This approach pinpoints where, how, and why threats matter to our clients.

Vulnerability Frameworks & Mapping

For over 25 years, ZRA has conducted vulnerability assessments by utilizing best practices and risk management tools. We perform endpoint detection and response and vulnerability mapping against high-value assets (HVAs) and national critical functions. ZRA has supported compliance with Office of Management & Budget (OMB) Memorandum 2131 to enhance the federal governments' investigative and remediation capabilities. We focus on event log management that aligns with the Continuous Diagnostics and Mitigation Program and delivers security data as part of the National Cyberspace Protection System.

HVA Blueprints®

ZRA provides functional HVA blueprints with essential cybersecurity information for client risk assessments, such as data storage, IT infrastructure, and internal business interactions. These blueprints are customized for unique HVAs, customer services, and critical infrastructure assurance. Our blueprints enable senior leaders, managers, and decision-makers to make well-informed risk decisions.

Baseline Security Metrics

ZRA assists clients in designing and implementing Baseline Security Metrics derived from new risk assessments or leadership requirements. Program managers can incorporate these metrics into Zero Trust Maturity Models and adhere to OMB and CISA directives, such as Binding Operational Directives, security log reporting, and portfolio risk calculations.

Customized Scenario Library

ZRA is a prominent provider of scenario libraries for clients with specialization in national security, critical infrastructure, and cybersecurity scenarios. For over 25 years, we have developed a comprehensive set of assumptions and risk data for clients to conduct thorough portfolio risk analyses and generate valuable data. Our methodology is based on best practices from the federal government, industry, and professional associations that address risk-related needs.

Leadership Decision Briefs & Memorandum