Cybersecurity · Advanced level

Advanced level · Module 1 of 6 · 22 guided hours

Security Governance and Risk Management

Govern cybersecurity as a business risk using the NIST Cybersecurity Framework 2.0.

Learning objectives

  • Explain the six CSF 2.0 Functions
  • Build current and target profiles
  • Assess and record cyber risks in a risk register
  • Report cyber risk to leadership

Topics

  • CSF 2.0 Functions
  • organisational profiles
  • assets and dependencies
  • risk assessment
  • risk register
  • governance and reporting

Lessons

  1. Lesson 1 The NIST Cybersecurity Framework 2.0

    Use CSF 2.0 as a common language for managing cybersecurity risk.

    GovernIdentify, Protect, DetectRespond, Recoveroutcomes not controls

  2. Lesson 2 Current and Target Profiles

    Describe where the organisation is and where it needs to be.

    current profiletarget profilegap analysispriorities

  3. Lesson 3 Assessing Cyber Risk

    Identify and rate risks by likelihood and impact on the mission.

    assetsthreats and vulnerabilitieslikelihood and impactrisk register

  4. Lesson 4 Reporting Cyber Risk to Leadership

    Explain cyber risk in terms leaders can act on.

    risk appetitebusiness languagekey risk indicatorsdecision requests

Practical activity

Build current and target CSF 2.0 profiles and a risk register for a case NGO with offices in two towns.

Expected outcomes

  • A risk-based view of security
  • Leadership-ready reporting

Assessment

Profiles and risk register reviewed for coherence, evidence and prioritisation.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.