SUMMARY
At ZRA, we have over 25 years of experience in providing comprehensive risk assessment and mitigation services to the Federal Government and critical infrastructure stakeholders. Our approach combines methodologies, data analysis, and scenario design to facilitate informed, risk-based decisions. We produce risk Blueprints® that serve as a long-term basis for assessing and refining risk over time, reflecting capital assets, high-value functions, and essential services. Our expertise extends to threat and TTP assessments, vulnerability frameworks and mapping, HVA Blueprints®, baseline security metrics, customized scenario libraries, and leadership decision briefs and memoranda. With a focus on understanding threat surfaces and their impact on organizations, we analyze threat data, evaluate attacker TTPs, and provide insights into IT, functional, and operational business processes. Our vulnerability assessments incorporate best practices and risk management tools, including endpoint detection and response, as well as mapping against High Value Assets (HVAs). We create functional Blueprints® that deliver essential cybersecurity information, and we assist clients in implementing baseline security metrics and designing customized scenario libraries. Our services are driven by industry best practices and informed by the needs of Federal Civilian Executive Branch entities. With our extensive experience and comprehensive methodologies, we empower organizations to make informed risk decisions and enhance their overall security posture.
ZRA Knows Threat
ZRA can provide insight into the complex array of threats that CISA faces in its mission to protect the Nation’s critical infrastructure. ZRA has 20 years of experience working with government agencies, including law enforcement and the intelligence community, and we have cultivated a deep understanding of the most sophisticated adversaries. Our team constantly tracks the threat landscape to stay abreast of evolving tactics, techniques, and procedures, and build adversary profiles. We can produce strategic and operational threat assessments to help CISA prioritize threats and inform mitigations.
ZRA Knows Vulnerability
ZRA has expertise in producing vulnerability assessments to help CISA manage risk to critical infrastructure. Our team has spent years developing a deep understanding of critical infrastructure, from the financial sector to the electrical grid, with a specialty in telecommunications and energy infrastructure. This expertise allows us to provide high-impact vulnerability assessments to give CISA a holistic, cross-sector view of the most pressing vulnerabilities. For example, we have worked with NRMC to develop methodologies to prioritize vulnerabilities to National Critical Functions. We also supported NRMC in identifying critical communications elements and determining criticality within the government’s supply chain.
ZRA Knows Consequence
ZRA provides consequence analysis so that CISA can gauge the potential impact of threats and vulnerabilities. We have designed multiple frameworks to assess consequences, using rigorous qualitative and quantitative metrics. We routinely develop analytically useful models and scenarios to provide leadership with accurate, actionable vulnerability assessments. For example, our team supported NRMC in developing the SARA Consequence Assessment Risk Framework to assess impacts to telecommunications. We have also supported the Scalable Consequence Equivalency Representations for Cyber (SCERC) to develop approaches to compare and aggregate consequence measures.
ZRA Can Provide an Integrated Risk Management Approach Combining TVC
ZRA delivers fully integrated risk management solutions to tackle CISA’s most pressing problems. We have supported various NRMC projects, including the design of the comprehensive Risk Architecture, the Cyber Risk Framework, and an ICT assessment. Our proven track record and cutting-edge research makes us an excellent partner to ensure agency mission performance.