Organisational Security Management for Risk Reduction Course

Lesson 1 • Defining Organisational Security Management

Introduces security management as a discipline distinct from IT security and physical protection alone. Connects holistic security thinking to organisational mission and continuity.

Lesson 2 • Core Security Concepts and Terminology

Defines threat, vulnerability, risk, and control as foundational vocabulary. Precise terminology enables consistent communication across departments and stakeholders.

Lesson 3 • Security Management Frameworks Overview

Surveys internationally recognised security management frameworks and standards. Provides a reference map for selecting appropriate frameworks based on organisational context.

Lesson 4 • Stakeholder Roles in Security Programmes

Maps executive, managerial, and operational security responsibilities. Clarifies how cross-functional collaboration sustains effective security programmes.

Lesson 1 • Qualitative Risk Assessment

Teaches likelihood-impact matrix construction and risk scoring using descriptive scales. Qualitative methods enable rapid prioritisation without requiring precise numerical data.

Lesson 2 • Risk Register Development

Guides construction of a structured risk register as the central risk management artefact. A well-maintained register enables tracking, reporting, and treatment planning.

Lesson 3 • Risk Prioritisation and Appetite

Explains how organisational risk appetite shapes prioritisation decisions. Students align risk rankings with strategic tolerance levels to guide treatment planning.

Lesson 4 • Quantitative Risk Assessment

Introduces numerical methods including annualised loss expectancy and exposure factor calculations. Quantitative outputs support cost-benefit analysis of security investments.

Lesson 1 • Control Categories and Types

Classifies controls as preventive, detective, corrective, and deterrent across physical, technical, and administrative domains. Classification guides balanced control portfolio design.

Lesson 2 • Risk Treatment Options

Explains the four treatment strategies: avoid, reduce, transfer, and accept. Matching treatment to risk profile and organisational context is the central skill.

Lesson 3 • Control Selection Criteria

Provides a structured approach to evaluating and selecting controls based on effectiveness, cost, and feasibility. Ensures control choices are defensible and proportionate.

Lesson 4 • Developing a Risk Treatment Plan

Guides creation of a formal treatment plan linking risks to controls, owners, timelines, and success metrics. The plan becomes the operational roadmap for risk reduction.

Lesson 1 • Surveillance and Detection Systems

Examines CCTV, intrusion detection, and alarm systems as detection and deterrence tools. Proper placement and monitoring protocols maximise detection effectiveness.

Lesson 2 • Environmental and Utility Controls

Addresses fire suppression, power redundancy, climate control, and water damage prevention. Environmental controls protect assets from non-human threats.

Lesson 3 • Access Control Systems

Covers credential-based, biometric, and multi-factor physical access technologies. Effective access control limits unauthorised entry and creates audit trails.

Lesson 4 • Physical Security Principles

Introduces crime prevention through environmental design and layered perimeter concepts. Physical security principles underpin all facility protection decisions.

Lesson 1 • Cyber Risk Integration with Organisational Risk

Demonstrates how cyber risks are assessed, scored, and incorporated into the enterprise risk register. Integration ensures cyber risk receives proportionate governance attention.

Lesson 2 • Cyber Threat Landscape

Surveys current cyber threat categories including malware, social engineering, and insider threats. Understanding the threat landscape informs risk identification and control selection.

Lesson 3 • Identity and Access Management

Explains authentication, authorisation, and privileged access management for digital systems. Strong identity controls are the primary defence against unauthorised access.

Lesson 4 • Network and System Security Controls

Covers firewalls, segmentation, patch management, and endpoint protection as foundational cyber controls. These controls reduce attack surface and limit lateral movement.

Lesson 1 • Security Policy Architecture

Explains the hierarchy of policies, standards, procedures, and guidelines. A coherent policy architecture ensures consistent security requirements across the organisation.

Lesson 2 • Security Governance Structures

Covers governance bodies, charters, and reporting lines that provide oversight of security programmes. Effective governance ensures accountability and strategic alignment.

Lesson 3 • Regulatory and Compliance Requirements

Surveys categories of regulatory obligations affecting security programmes across sectors. Compliance mapping prevents gaps and demonstrates due diligence to regulators.

Lesson 4 • Compliance Monitoring and Reporting

Teaches continuous compliance monitoring, internal audit, and executive reporting techniques. Regular reporting sustains governance accountability and identifies emerging gaps.

Lesson 1 • Testing, Exercises, and Post-Incident Review

Covers tabletop exercises, simulations, and after-action reviews to validate and improve plans. Regular testing reveals gaps before real incidents expose them.

Lesson 2 • Incident Detection and Classification

Covers event monitoring, alert triage, and incident classification criteria. Accurate classification determines response priority and resource allocation.

Lesson 3 • Incident Response Planning

Guides development of a structured incident response plan covering roles, procedures, and communication. A tested plan reduces response time and limits incident impact.

Lesson 4 • Business Continuity Planning

Teaches business impact analysis and continuity strategy development for critical functions. Continuity planning ensures essential operations survive disruptive security events.

Lesson 1 • Continuous Improvement and Maturity Models

Introduces security maturity models as tools for benchmarking and guiding programme improvement. Maturity assessments provide a structured path from reactive to optimised security.

Lesson 2 • Security Strategy Development

Guides creation of a multi-year security strategy aligned with business goals and risk profile. Strategy development translates risk priorities into a coherent investment roadmap.

Lesson 3 • Security Budget and Resource Management

Covers security budget development, justification, and resource allocation techniques. Effective resource management maximises risk reduction per unit of investment.

Lesson 4 • Security Metrics and Performance Management

Establishes key performance and risk indicators for measuring programme effectiveness. Metrics enable data-driven decisions and demonstrate security value to leadership.