HS39
Course Contents
Module 1: Cyber Governance and Integrated Risk Management
Key Topics
- Cyber risk within enterprise governance and strategy
- Roles of boards, executives, legal, IT and data owners
- Cyber risk appetite, tolerance and escalation criteria
- Asset identification and information risk assessment
- Policies, standards, procedures and control ownership
- Cyber security frameworks and management system principles
- Risk registers, indicators and management reporting
Module 2: Information Governance and Records Management
Key Topics
- Information lifecycle from creation to secure disposal
- Data ownership, stewardship and accountability
- Information classification and handling requirements
- Records capture, metadata and authenticity controls
- Retention schedules and defensible disposal
- Legal holds, preservation and document control
- Cloud, email and collaboration platform governance
Module 3: Privacy, Regulation and Legal Risk
Key Topics
- Privacy principles and lawful information processing
- Data mapping, purpose limitation and minimisation
- Contracts, confidentiality and information security clauses
- Cross-border transfers and jurisdictional risk
- Intellectual property and commercially sensitive information
- Regulatory duties, evidence and accountability records
- Legal risk assessment for new technologies and projects
Module 4: Cyber Controls and Third-Party Assurance
Key Topics
- Identity, access and privileged account management
- Secure configuration, patching and vulnerability management
- Encryption, backups and data loss prevention
- Security monitoring, detection and alert management
- Supplier due diligence and contractual security controls
- Cloud services, outsourcing and shared responsibility
- Staff awareness, phishing defence and insider risk
Module 5: Incidents, Investigations and Organisational Resilience
Key Topics
- Incident response roles, plans and escalation paths
- Breach assessment and regulatory notification decisions
- Digital evidence, chain of custody and legal privilege
- Internal investigations and stakeholder communications
- Ransomware, extortion and cyber insurance considerations
- Business continuity, recovery and lessons learned
- Audit, assurance and governance improvement planning
