What you will be able to do
- Perform a basic information security risk assessment
- apply recognised control frameworks at a small-business level
- write policies
- run an awareness programme
- prepare an audit report
Syllabus
- 1 Risk concepts and asset registers
- 2 Threats and vulnerabilities
- 3 Controls and policies
- 4 Frameworks for small organisations
- 5 Business continuity and recovery
- 6 Third-party and cloud risk
- 7 Audit method
- 8 Awareness training
- 9 Incident response exercise
- 10 Risk and audit project
Hands-on practical activities
- Risk assessment of a school or SME
- phishing simulation in a controlled environment
- tabletop incident exercise
- audit report
Resources and equipment
Laptops, risk register templates, sample policies, simulation tools in an isolated lab
🔋 No power? Off-grid option
Document-based work plus offline lab
Career direction
IT auditor, risk analyst, security awareness officer, governance and compliance specialist
Why it matters in the market
Regulators, banks, schools and NGOs need people who can assess and manage cyber risk
Assessment
Risk assessment and audit report
Progression
From EX7 or MK6; stacks with MH1