CISO Training Course

Lesson 1 • Corporate Governance and Accountability

Examines how the CISO fits within board-level governance structures. Connects security leadership to fiduciary and organisational accountability.

Lesson 2 • Security Culture and Organisational Influence

Addresses how CISOs shape enterprise-wide security behaviour. Builds on governance concepts to extend CISO influence across business units.

Lesson 3 • Defining the CISO Function

Covers the historical evolution and current mandate of the CISO role. Anchors the chapter by establishing baseline expectations for scope and authority.

Lesson 1 • Risk Treatment and Acceptance

Examines the four treatment options: mitigate, transfer, accept, and avoid. Guides learners in selecting and documenting treatment decisions.

Lesson 2 • Risk Management Fundamentals

Introduces core risk concepts including threat, vulnerability, likelihood, and impact. Establishes the vocabulary and mental models used throughout the chapter.

Lesson 3 • Continuous Risk Monitoring

Establishes processes for ongoing risk review and reassessment. Builds on treatment decisions to create a dynamic, living risk programme.

Lesson 1 • Policy Communication and Enforcement

Covers strategies for communicating policies and ensuring compliance across the workforce. Completes the governance cycle by linking policy creation to measurable adherence.

Lesson 2 • Security Governance Frameworks

Surveys leading governance frameworks and their structural components. Provides the foundation for selecting and adapting a framework to organisational context.

Lesson 3 • Policy Hierarchy and Architecture

Defines the relationship between policies, standards, procedures, and guidelines. Enables learners to design a consistent and enforceable policy structure.

Lesson 1 • Legal Obligations and Incident Disclosure

Addresses breach notification requirements and legal counsel coordination. Extends compliance knowledge to crisis scenarios with legal implications.

Lesson 2 • Understanding the Regulatory Landscape

Maps the categories of regulations affecting information security across industries and regions. Establishes context for compliance programme design.

Lesson 3 • Audit Readiness and Evidence Management

Prepares CISOs to manage internal and external audits effectively. Builds on compliance programme design to ensure evidence is collected and maintained continuously.

Lesson 1 • Identity and Access Management Strategy

Covers IAM as a foundational security control spanning authentication, authorisation, and lifecycle management. Connects identity strategy to broader architecture goals.

Lesson 2 • Technology Investment and Vendor Strategy

Guides CISOs in evaluating, selecting, and managing security technology vendors. Applies architecture knowledge to procurement and portfolio management decisions.

Lesson 3 • Network and Endpoint Security Architecture

Examines segmentation, perimeter controls, and endpoint protection strategies. Builds on architecture principles to address the most common attack surfaces.

Lesson 4 • Cloud and Hybrid Security Architecture

Addresses security design for cloud-native and hybrid environments. Extends on-premises architecture knowledge to modern infrastructure models.

Lesson 1 • Incident Response Planning and Execution

Defines the incident response lifecycle from preparation through lessons learned. Provides the structured process for managing security events at scale.

Lesson 2 • Threat Detection and Intelligence

Examines detection engineering, use-case development, and threat intelligence integration. Connects operational tooling to proactive threat identification.

Lesson 3 • Security Operations Centre Design

Covers SOC models, staffing, and tooling required for effective threat monitoring. Establishes the operational foundation for detection and response capabilities.

Lesson 4 • Digital Forensics and Evidence Handling

Introduces forensic principles relevant to CISO oversight of investigations. Ensures learners can direct forensic work and preserve evidentiary integrity.

Lesson 1 • Vendor Due Diligence and Assessment

Covers pre-contract security assessments and ongoing vendor evaluations. Connects risk tiering to proportionate assessment depth and frequency.

Lesson 2 • Contractual Security Requirements

Defines the security clauses and obligations that must be embedded in vendor contracts. Applies assessment findings to enforceable contractual protections.

Lesson 3 • Third-Party Risk Programme Foundations

Establishes the scope, objectives, and governance of a third-party risk management programme. Provides the structural basis for all vendor risk activities.

Lesson 1 • Security Budget Planning and Management

Covers budget construction, justification, and optimisation for security programmes. Connects strategic priorities to resource allocation and financial accountability.

Lesson 2 • Board and Executive Reporting

Develops skills for presenting security posture and risk to board-level audiences. Applies metrics and strategy knowledge to high-stakes executive communication.

Lesson 3 • Developing a Multi-Year Security Strategy

Guides the creation of a long-term security roadmap aligned to business strategy and risk posture. Synthesises governance, risk, and architecture knowledge into a strategic plan.

Lesson 4 • Security Metrics and Programme Performance

Establishes a metrics framework for measuring and communicating security programme effectiveness. Enables data-driven decision-making and executive reporting.