Cybersecurity Governance, Risk & Compliance

Introduce governance, risk, and compliance within cybersecurity, and establish foundational GRC documentation.

Module 1: Governance & Structures

• 1.1 governance, risk, and compliance explained, the role of GRC within cybersecurity, governance structures, board and executive responsibilities, security leadership and accountability, roles and responsibilities, security policies and procedures

Module 2: Information Security Fundamentals

• 2.1 information assets, data classification, confidentiality, integrity, and availability, security principles, threats, vulnerabilities, and risks: risk vs threat vs vulnerability, risk ownership, risk appetite, risk tolerance, security objectives, security metrics and KPIs

Module 3: Frameworks & Ethics

• 3.1 introduction to ISO 27001, NIST CSF, CIS Controls, and COBIT, professional ethics and confidentiality, GRC documentation

Capstone: Cybersecurity Governance Foundation Project

• 4.1 Learners design a basic governance structure for a fictional organisation, including a governance structure, security policies, roles and responsibilities, an asset inventory, a data classification scheme, and an initial risk register.

Apply risk management principles to identify, assess, treat, and report cybersecurity risk.

Module 1: Risk Principles

• 1.1 risk identification, assessment, analysis, evaluation, and treatment, risk acceptance, avoidance, mitigation, transfer, and monitoring

Module 2: Risk Assessment

• 2.1 qualitative and quantitative risk assessment, likelihood and impact, risk scoring, inherent and residual risk, risk appetite and tolerance

Module 3: Risk Documentation & Reporting

• 3.1 risk treatment plans, risk registers, risk ownership, Key Risk Indicators (KRIs), risk reporting, threat modelling fundamentals, business impact analysis, asset criticality, security control selection, risk documentation

Capstone: Enterprise Cybersecurity Risk Assessment

• 4.1 Learners conduct a complete cybersecurity risk assessment for a fictional organisation, delivering an asset register, threat register, vulnerability register, risk register, risk matrix, risk treatment plan, residual risk assessment, and executive risk report.

Apply ISO 27001/27002 and other security frameworks to build a control environment and identify gaps.

Module 1: ISO 27001 & ISMS

• 1.1 ISO/IEC 27001, ISO/IEC 27002, Information Security Management System (ISMS) principles, context of the organisation, interested parties, leadership and commitment, information security objectives, risk assessment and treatment, Statement of Applicability

Module 2: Security Controls

• 2.1 security controls: ownership, design, implementation, effectiveness, evidence collection, documented information, continuous improvement

Module 3: Framework Mapping

• 3.1 NIST Cybersecurity Framework, CIS Controls, framework mapping, control crosswalks, gap assessments

Capstone: ISO 27001 Readiness & Gap Assessment

• 4.1 Learners assess a fictional organisation against an ISO 27001-based ISMS, identifying existing controls, missing controls, control gaps, risk implications, required evidence, remediation actions, and implementation priorities.

Apply data protection and privacy principles, and manage cybersecurity compliance obligations.

Module 1: Compliance Principles

• 1.1 cybersecurity compliance principles, regulatory vs contractual requirements, data protection principles, GDPR fundamentals, UK data protection environment

Module 2: Data Protection

• 2.1 personal data, special-category data, data controllers and processors, data protection responsibilities, data processing principles, lawful processing concepts, data subject rights, data retention, data minimisation, privacy by design

Module 3: Privacy Operations

• 3.1 Data Protection Impact Assessments (DPIAs), data breach management, third-party data processing, international data transfers, records of processing activities, privacy policies, compliance obligations register, regulatory monitoring, compliance evidence

Capstone: GDPR & Cybersecurity Compliance Assessment

• 4.1 Learners assess an organisation's handling of personal data and develop a remediation programme covering data protection, security controls, privacy, documentation, data retention, third-party processing, and incident/breach response.

Plan and conduct an internal cybersecurity audit, from evidence collection through to reporting.

Module 1: Audit Planning

• 1.1 internal audit fundamentals, audit planning, scope, objectives, criteria, and programmes

Module 2: Evidence & Control Testing

• 2.1 audit evidence collection: interviews, document reviews, sampling, control testing: design effectiveness, operating effectiveness, compliance testing

Module 3: Findings & Assurance

• 3.1 audit findings, non-conformities, observations, root cause analysis, corrective actions, remediation tracking, audit reports, management responses, audit follow-up, continuous assurance, GRC dashboards, security metrics

Capstone: Cybersecurity Internal Audit Project

• 4.1 Learners conduct a simulated internal cybersecurity audit, delivering an audit charter, scope, and plan, an audit checklist, control test procedures, an evidence register, findings, root-cause analysis, a corrective action plan, a final audit report, and an executive presentation.

Assess and manage cybersecurity risk introduced by vendors and the supply chain.

Module 1: Vendor Risk Fundamentals

• 1.1 third-party cybersecurity risk, vendor risk management, supplier risk assessment, supply-chain cybersecurity, vendor classification, critical suppliers, due diligence, security questionnaires, vendor security assessments

Module 2: Contractual & Ongoing Risk

• 2.1 contractual security requirements, service-level agreements, data processing agreements, security clauses, right-to-audit provisions, vendor risk scoring, continuous vendor monitoring, third-party risk registers

Module 3: Cloud & Outsourcing Risk

• 3.1 cloud supplier risk, software supply-chain risk, outsourcing risk, vendor incident management, supplier offboarding

Capstone: Third-Party Cybersecurity Risk Management Programme

• 4.1 Learners establish a complete vendor-risk management process for an organisation with multiple technology suppliers, delivering a vendor inventory, risk classification, a due-diligence questionnaire, a risk scoring model, contractual requirements, a remediation plan, a monitoring framework, and an executive vendor-risk report.

Develop business continuity, disaster recovery, and incident-governance capability for cyber resilience.

Module 1: Business Continuity

• 1.1 business continuity management, cyber resilience, Business Impact Analysis, critical business processes, recovery objectives (RTO, RPO), disaster recovery

Module 2: Incident Governance

• 2.1 business continuity plans, crisis management, incident response governance, cyber incident escalation, incident classification, roles and responsibilities, crisis communications, regulatory notification considerations, lessons learned

Module 3: Resilience Testing

• 3.1 tabletop exercises, cyber resilience metrics, recovery planning, backup governance, disaster recovery testing, operational resilience

Capstone: Cyber Resilience & Business Continuity Programme

• 4.1 Learners simulate a major cyber incident and develop a governance-led response covering incident, escalation, decision making, communication, recovery, and lessons learned, delivering an executive incident report and a resilience improvement plan.

Bring the entire programme together into a complete enterprise cybersecurity GRC programme for a realistic organisation. This is the final graduation project.

Module 1: Enterprise GRC Architecture

• 1.1 GRC operating models, GRC maturity models, security governance structures, enterprise risk management, security strategy, security roadmaps, cybersecurity budgets

Module 2: Executive Reporting & Automation

• 2.1 executive and board-level cybersecurity reporting, risk dashboards, security KPIs and KRIs, compliance dashboards, control monitoring, GRC automation, GRC platforms, workflow automation, evidence management, continuous compliance, regulatory change management

Module 3: Programme Management & Tools

• 3.1 security awareness governance, cybersecurity programme management, GRC documentation, professional reporting, stakeholder management, communicating technical risk to executives, GRC career development, exposure to GRC platforms and workflows such as ServiceNow GRC, RSA Archer, OneTrust, Microsoft Purview, Jira, Confluence, Excel, Power BI, and SharePoint

Capstone: Enterprise Cybersecurity GRC Programme

• 4.1 The programme's flagship project: learners design a complete GRC programme for a realistic organisation covering governance, risk management, compliance, security controls, audit, privacy, third-party risk, resilience, reporting, and a GRC roadmap from current to target maturity.