Description

A focused course, tailored for you

Cyber Security Portfolio Management for Financial Services

Build the portfolio reporting structure that satisfies your risk committee and your next regulatory review.

The quarterly APRA portfolio attestation is six weeks away. Forty-three active remediations, eleven regulatory commitments in flight, and a board risk committee that wants one page. The hardest part is not the technical work. It is building the evidence architecture that connects each remediation decision to the risk register, so the portfolio story holds when an examiner reads it from the other direction.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Cyber security portfolio managers in financial services occupy a specific and difficult position: they understand the technical risk well enough to prioritize it, and they are accountable for the board-level narrative that describes it. The gap that causes problems is not knowledge. It is the evidence architecture that links those two worlds.

When APRA examiners review a cyber security portfolio, they read it backwards: starting from the risk appetite statement, through the risk register, through the remediation record, through to the individual project closure evidence. Most portfolio views are built forwards, from project status up to a summary. When read in reverse, the chain breaks.

The consequences compound. An attestation that cannot be followed by an examiner triggers requests for supplementary evidence, then findings, then enhanced supervision conversations. The operational cost is the recurring six-week sprint: senior capacity consumed each attestation cycle to rebuild evidence that could have been captured continuously.

The skill gap is specific: how to design a portfolio governance architecture that produces the APRA-ready evidence pack as a routine output, rather than an exceptional effort.

What you walk away with

Build a portfolio risk register that connects individual control gaps to the organizational risk appetite statement and survives a risk committee challenge.
Design the evidence chain from remediation project completion back to the originating risk finding, audit-ready at any point in the cycle.
Write the board risk committee cyber portfolio update that answers the CRO's first question without a follow-up slide.
Sequence remediation priorities against budget cycles, regulatory timelines, and residual risk movement using a defensible methodology.
Prepare the APRA CPS 234 attestation-ready closure pack that an examiner can follow from control domain to closure evidence without a briefing.

The 12 modules

Module 1. The Portfolio View an APRA Examiner Actually Reads

How APRA CPS 234 defines information security capability at the portfolio level, what the prudential standard requires in terms of attestable evidence, and how most portfolio views fail the first read. Build the structural map from individual control domains up to the board-level risk narrative, with the examiner's reading direction built in from the start.

Module 2. Risk Appetite Translation

Your risk appetite statement says low tolerance for critical control failures. Your portfolio has forty-three active remediations. This module builds the translation layer: how to map each open item against the risk appetite scale, assign a residual risk rating that survives challenge, and produce the single-number portfolio risk score that the CRO can quote in committee without a follow-up question.

Module 3. Remediation Evidence Architecture

The evidence chain that satisfies internal audit and satisfies an APRA examiner runs from the original risk finding through the remediation project deliverable to the closure approval and the control re-test result. This module builds that chain as a replicable architecture: what documents are required at each stage, who signs off, and how to store and retrieve evidence without rebuilding it from scratch each attestation cycle.

Module 4. Portfolio Prioritization under Budget Constraints

When three remediations miss their timeline because headcount moved to a business-critical delivery, you need a framework for recalibrating priority that is defensible to a risk committee. This module covers the prioritization methodology: residual risk movement rate, regulatory commitment sensitivity, and the dependency map that identifies which remediation completion unlocks three others downstream.

Module 5. Regulatory Commitment Tracking

APRA commitments, internal audit findings, and board risk committee actions arrive through different channels and track on different timescales. This module builds the unified commitment register: how to merge the three streams, assign owners, track milestone evidence, and produce the status view that satisfies all three audiences simultaneously without maintaining three separate trackers.

Module 6. Board Risk Committee Reporting

The one-page portfolio update that a non-technical board chair can read in ninety seconds and the detailed heat map that the CRO can interrogate are different artefacts from the same data. This module designs both: the executive narrative structure, the heat map layout that shows movement rather than position, and the exception logic that elevates the right items for decision.

Module 7. Third-Party Cyber Risk in the Portfolio

Financial institutions with global operations manage dozens of critical supplier relationships, each carrying cyber risk that lands in your portfolio. This module covers supplier risk integration: how to maintain a defensible supplier risk rating, what evidence you need at each tier, and how to represent third-party cyber risk on the same portfolio view without creating a separate program that nobody reads consistently.

Module 8. Incident-to-Portfolio Feedback Loop

When a security incident closes, it either validates a portfolio decision or contradicts one. Most portfolio managers treat incidents as separate from the portfolio cycle. This module builds the feedback loop: how to conduct the post-incident review that updates the risk register, identifies portfolio gaps the incident exposed, and produces the lessons-learned artefact that satisfies both internal audit and APRA.

Module 9. Attestation Preparation and Closure Packs

The APRA CPS 234 attestation cycle has a defined evidence burden. This module walks through the preparation sequence: the evidence audit six weeks out, the gap-fill timeline, the closure pack structure that groups evidence by control domain, and the review protocol that catches ambiguity before the examiner does, not after the finding is raised.

Module 10. Stakeholder Communication for Portfolio Decisions

When you defer a remediation because budget was reallocated, the communication to the risk committee, the internal audit lead, and the APRA relationship manager each requires a different frame. This module covers the communication approach for each stakeholder type: what they need to hear, what question they will ask first, and how to log the decision without inadvertently creating a new audit finding.

Module 11. Portfolio Maturity Assessment and Roadmap

How to assess the maturity of your cyber security portfolio governance function against the APRA prudential standard and the NIST Cybersecurity Framework, identify the three highest-leverage improvements, and build a twelve-month portfolio governance roadmap you can present to the board as evidence of proactive capability development rather than reactive remediation response.

Module 12. Building the Permanent Attestation Machine

The goal is a portfolio governance system that produces the APRA attestation pack, the board risk committee update, and the internal audit response as routine monthly outputs rather than a six-week sprint. This module builds the permanent operating model: the monthly cadence, the evidence collection checkpoints, the quarterly risk register refresh, and the annual maturity review cycle.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Your APRA attestation cycle is thirty to forty-five days out and the evidence trail has gaps: start with modules 9 and 3.

Your board risk committee update lands in two weeks and you need the heat map logic built: start with module 6.

A new regulatory commitment just arrived and you need to integrate it into the portfolio tracker: start with module 5.

You are building the portfolio governance function from scratch and need the full sequence: work modules 1 through 12 in order.

What you get with this course

Twelve written modules with worked examples and downloadable templates for every stage of the portfolio governance cycle
A portfolio risk register template pre-mapped to APRA CPS 234 evidence categories
A closure pack template for attestation evidence grouping by control domain
A board risk committee update template with heat map layout and exception logic included
The hand-built implementation playbook tailored to your specific portfolio structure and regulatory commitment timeline

What you will have in hand by Day 1, Week 1, Month 1

Purchase triggers immediate course access provisioning and the start of the implementation playbook build.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Before and after

Before

Portfolio view that satisfies project managers but fails the first read of an APRA examiner. Evidence scattered across project folders and email threads. Attestation preparation requires a six-week sprint of senior capacity twice a year.

After

Portfolio governance architecture that produces the attestation pack, board update, and audit response as routine monthly outputs. Evidence chain that an examiner can follow from finding to closure without a supplementary briefing or a sprint to reconstruct it.

What happens if you do not address this

The APRA CPS 234 penalty framework includes pathways to enhanced supervision when portfolio governance is found inadequate. Beyond the regulatory exposure, the recurring attestation sprint compounds: senior capacity consumed each cycle to rebuild evidence that could have been captured continuously. The gap between a portfolio view that reads well internally and one that holds up under regulatory scrutiny is specific and teachable. It does not close on its own.

Who it is for

Cyber Security Portfolio Managers and Cyber Risk Program Leads at financial institutions with three or more years in the role, accountable for the quarterly APRA CPS 234 attestation, the board risk committee update, and the internal audit response cycle. Typically managing a portfolio of fifteen to sixty active remediations across multiple control domains, reporting into the CISO or the Chief Risk Officer. Responsible for translating technical risk into regulatory and business language without losing the substance in either direction.

Who this is NOT for. IT project managers without a security risk remit. CISOs who have a portfolio management team and do not need to build the capability themselves. Security consultants seeking a tool certification rather than a portfolio governance framework.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Three to four hours per module, twelve modules total. Most portfolio managers complete modules 1, 3, and 9 first to address the immediate attestation gap, then work through the remaining modules against the next review cycle.

Why $199 is the right number

Engaging a cyber security governance consultant to build this architecture typically costs $15,000 to $50,000 for a scoped engagement. You own the output but cannot iterate without re-engaging. Internal teams building from scratch spend months without a reference model for what an APRA examiner expects to find. This course delivers the reference model, the templates, and the implementation playbook specific to your portfolio.

FAQ

Is this specific to Australian financial services?

The evidence architecture and portfolio governance framework apply to any financial institution subject to prudential regulation. APRA CPS 234 is addressed directly in modules 1, 9, and 12. Modules 3 through 8 apply equally to CPS 234, DORA, MAS TRM, and FCA operational resilience requirements.

How is the implementation playbook tailored to my portfolio?

After purchase, Gerard reviews your current portfolio structure, regulatory commitment timeline, and the specific gaps you have identified. The playbook is built to your actual portfolio, not a generic template.

Does this cover third-party and supplier cyber risk?

Yes. Module 7 addresses supplier risk integration specifically: defensible supplier risk ratings, the evidence requirements at each supplier tier, and how to represent third-party cyber risk on the same portfolio view without a separate reporting stream.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.