DRC-5 Governance, Risk and Culture

The course provides knowledge of how organisations govern and organise information security, and skills to assess risk and set up a management system that fits the organisation. It introduces security leadership roles and how responsibility for security is organised.

Students learn governance models and how an information security management system based on ISO 27001 is set up to fit the needs and size of an organisation. They assess information assets and risks, including risks from AI, automation and suppliers, and determine what measures need to be implemented. Students write security policies and change processes that are followed in practice, and assess their own policies and risk assessments against ISO 27001 and the organisation's requirements. The course also covers security culture and human behaviour, and how security is measured and reported to management, where students explain their risk decisions.