AP Cybersecurity Risk Assessment: Threat, Vulnerability and Impact (2027 Prep)

A former club coordinator's account can still edit a school's room-booking portal. The enabled account is a weakness. Someone using it without authorization to change reservations is a possible threat event, while disrupted club meetings would be a consequence.

Keep those pieces separate. For AP Cybersecurity risk assessment, a useful explanation names the asset, describes what could happen, identifies the condition that makes it possible and explains the harm. Likelihood and existing safeguards also matter.

Below, the school develops two risk records. It also shows what to write when you know a weakness exists but lack enough evidence to assign a defensible likelihood or overall rating.

Connect the vocabulary to the current framework

College Board's current AP Cybersecurity course and exam description places the risk assessment process in Topic 2.1.D. It includes assets, threats, vulnerabilities, likelihood, damage and documentation. This 2027 preparation edition uses that current framework, without treating the fictional school's labels as an official scoring rubric.

Organize your wider study through the AP Cybersecurity Online Center. The task here is narrower: build an explanation that another reader can trace back to supplied facts and clearly stated assumptions.

The NIST SP 800-30 Revision 1 is a technical reference for risk assessment, including uncertainty and organization-specific assessment methods. Its published examples are not the school's facts, and this tutorial does not reproduce a NIST risk matrix.

Set the scope before naming a risk

Our fictional school uses one portal to book rooms for after-school clubs, and the assessment covers booking records, staff access and recovery of those records. It stores no student personal details.

The schedule has practical value. Staff rely on its accuracy to allocate rooms, and need it available before clubs meet. Confidentiality still matters where access restrictions apply, but the two scenarios below focus on integrity and availability.

The supplied review finds a former coordinator's account still enabled seven days after departure. It can edit bookings for the photography room only. The school's stated policy requires disabling departed staff accounts within twenty-four hours, so this condition conflicts with that fictional policy.

A second finding concerns recovery. The portal creates a daily backup on the same disk as the live booking data, and the portal process can write to both. No separate recoverable copy or recent restoration test is supplied, leaving the review unable to confirm whether the school could recover from the loss of this disk.

These are scenario facts. No attack, unauthorized edit or loss of data has been observed in the evidence provided, and the example should not be read as a report about a real school.

Write the first risk as an event with a consequence

For R1, the asset is the photography room's booking record and the integrity of its reservations. The weakness is the departed coordinator's enabled editing access. A possible threat event is an unauthorized person using that account to alter bookings.

State the consequence. A room conflict could disrupt the photography meeting. The account's limited editing scope matters because this supplied permission does not allow changing every room's bookings.

An enabled account is not an attacker. It is a condition that may provide an access route if someone can satisfy the account's authentication requirements. The supplied review does not establish who knows the password or whether this particular account requires MFA.

A bounded risk statement is: Unauthorized use of the departed coordinator's enabled account could alter photography-room bookings and disrupt a club meeting. That statement connects the weakness to potential harm without claiming that unauthorized use already happened.

Write the second risk around a shared failure condition

For R2, the asset is the availability and recoverability of the complete booking schedule. The weakness is keeping the only supplied backup on the live disk, writable by the same portal process.

Consider malicious execution with that process's write permissions. Such activity could damage both the live data and the backup, leaving staff without a usable schedule. This is a possible event under the stated permissions, rather than a claim that every piece of malware necessarily destroys backups.

Keep the assumption attached. The supplied facts do not demonstrate that an adversary can currently execute code as the portal process. They identify why recovery could fail if that capability were obtained and used against both copies.

The impact is broader than R1's single-room conflict. Losing the complete schedule could disrupt several clubs, and no verified recovery time is available. Backup frequency alone does not establish that a usable copy survives the event being assessed.

Rate impact with an explicitly local scale

Use three impact descriptions for this school. Low means a small error corrected before any meeting is disrupted, while Medium means one club meeting is disrupted and other rooms remain usable. High means several club meetings are disrupted or the complete schedule is unavailable when needed.

These are local editorial labels. They are neither College Board marks nor universal cybersecurity thresholds, and a different organization could define its categories differently.

Under these definitions, R1 has a potential Medium impact if the booking conflict disrupts the photography meeting, whereas R2 has a potential High impact if both usable copies are lost before clubs meet. Each label depends on its stated event and consequence, rather than on how alarming the weakness sounds.

The label needs its explanation. A bare High would hide whether the concern was disclosure, inaccurate data, a service outage or some combination of harms.

Record unknown likelihood without calling it low

Neither likelihood can be assessed from the supplied evidence. For R1, you still need account-specific authentication details, credential exposure and relevant activity history. For R2, you need evidence about execution paths, permissions and safeguards that affect the proposed event.

Write Not assessed. That describes an unfinished estimate, while Low would assert a judgment that the supplied facts do not support. An absence of observed attacks in this small review cannot establish that the likelihood is low.

Keep overall risk unassigned too. The records have potential impact labels and documented weaknesses, but no justified combined risk rating. Further evidence and the school's declared assessment method are needed to complete that rating.

Avoid manufactured arithmetic. Giving Medium a number and multiplying it by an invented likelihood would not turn missing evidence into a measured probability or expected financial loss.

Choose useful actions while the assessment is incomplete

The fictional policy violation still needs attention. An authorized account administrator can disable the departed coordinator's access, check related sessions and verify the result. Correcting a known access-control gap need not wait for a precise estimate of how often someone might exploit it.

For recovery, the system owner can investigate an appropriately protected separate copy and test restoration within the organization's approved process. The relevant question is whether usable booking data can be recovered after the event, rather than whether a backup job merely reports completion.

These are proposed actions. They have not been carried out in this example, so the risk register should retain an owner, planned verification and pending status.

Do not rank the two overall risks solely from Medium versus High impact. Those labels describe consequences under the school's scale, while comparative risk also needs likelihood and the effects of existing controls.

Reassess after evidence of the control working

Residual risk remains after controls are applied. A planned control has not yet earned an improved assessment, and a purchase receipt alone does not show that a safeguard works in this system.

For R1, verification would check that the departed account cannot authenticate and that any relevant existing access is revoked as required. Other accounts or access routes remain separate questions, so closing this record's specific gap does not establish that the entire portal is secure.

For R2, useful verification would establish that a protected recoverable copy survives the assessed event and can restore the required schedule. Document the test conditions and limitations.

Update the record from evidence. If recovery succeeds only for yesterday's copy, the potential loss of newer bookings still needs consideration. Reduced risk does not mean zero risk.

Make the risk register readable by another person

The worked table keeps the two records distinct. Both have an evidence-backed weakness, a conditional event, a potential impact and an explicit assessment gap. Their likelihood and overall risk remain Not assessed.

Build your records in the blank risk register (CSV). Name the scope and asset before writing the event, then keep the observed condition separate from the assumed capability and possible consequence.

Use the owner and verification columns to identify who will obtain the missing evidence and how they will demonstrate that a proposed control works. For this school, checking account authentication and testing recovery answer different questions, so one generic instruction to improve security would lose the purpose of each action.

Continue through the AP Cybersecurity Online Center when you are ready to connect risk assessment with controls and detection. Keep the reasoning beside the rating, so a later reader can see what new evidence would change your assessment.

2027 preparation edition. Current College Board framework and NIST reference checked October 11, 2026. School, policy, findings and impact scale are original fictional teaching material, not an actual risk assessment or official/recalled exam questions. Proposed controls and verification remain pending. Local labels do not represent official scoring or measured probabilities.