Description

This curriculum spans the design and operationalization of enterprise cybersecurity programs with a scope comparable to a multi-phase advisory engagement, covering governance, risk modeling, control implementation, and resilience planning across business units and third parties.

Module 1: Establishing the Cybersecurity Governance Framework

Decide on the integration model between existing enterprise risk management (ERM) and cybersecurity risk functions—centralized, federated, or decentralized.
Select and customize a regulatory alignment strategy across NIST CSF, ISO/IEC 27001, and sector-specific mandates such as HIPAA or GLBA.
Define board-level reporting cadence and content, including risk appetite thresholds and escalation triggers.
Assign formal accountability for cyber risk ownership across business units using RACI matrices.
Implement a governance charter that specifies authority for risk acceptance, transfer, or mitigation decisions.
Establish a cybersecurity steering committee with representation from legal, compliance, IT, and business operations.
Negotiate thresholds for material cyber incidents requiring disclosure to regulators or shareholders.
Conduct a gap analysis between current governance maturity and target state using a recognized maturity model (e.g., CMMI).

Module 2: Risk Assessment and Threat Modeling

Conduct asset-criticality assessments to prioritize systems based on business impact, not technical exposure alone.
Select and apply threat modeling methodologies (e.g., STRIDE, PASTA) to high-risk applications during design phases.
Integrate threat intelligence feeds into risk scoring models to adjust likelihood estimates dynamically.
Determine whether to use quantitative (FAIR) or qualitative risk scoring based on data availability and stakeholder needs.
Define criteria for when a vulnerability warrants immediate remediation versus compensating controls.
Map attack paths from external perimeters to crown-jewel assets using network segmentation analysis.
Validate risk assessment outputs with red team findings to correct over- or under-estimation biases.
Document assumptions and limitations in risk models to support audit and legal defensibility.

Module 3: Security Controls Selection and Implementation

Choose between commercial, open-source, or custom-built security tools based on integration complexity and long-term TCO.
Implement defense-in-depth controls across network, endpoint, and identity layers with defined interdependencies.
Configure EDR/XDR platforms with tuned detection rules to reduce false positives without increasing dwell time.
Enforce least-privilege access through role-based (RBAC) or attribute-based (ABAC) access control models.
Deploy network segmentation using micro-segmentation or VLANs based on data flow analysis and breach containment goals.
Integrate multi-factor authentication (MFA) across cloud and on-prem systems, prioritizing external-facing and admin access.
Standardize logging formats and retention policies across control systems to support forensic readiness.
Conduct control effectiveness testing through purple team exercises at least annually.

Module 4: Incident Response Planning and Execution

Define incident classification criteria (e.g., severity, data type, affected systems) to trigger appropriate response protocols.
Establish communication protocols for internal stakeholders, legal counsel, PR, and regulators during active incidents.
Pre-negotiate contracts with forensic firms, legal advisors, and cyber insurance providers for rapid engagement.
Conduct tabletop exercises simulating ransomware, insider threat, and supply chain compromise scenarios.
Design and test data preservation workflows to maintain chain-of-custody for potential litigation.
Implement automated playbooks in SOAR platforms for common incident types (e.g., phishing, malware).
Determine when to isolate systems versus allowing monitored compromise for threat intelligence gathering.
Document post-incident timelines and decision logs for regulatory reporting and internal review.

Module 5: Third-Party and Supply Chain Risk Management

Classify vendors by risk tier based on data access, system criticality, and geographic jurisdiction.
Require third parties to provide evidence of security controls via SOC 2 reports or customized questionnaires.
Implement continuous monitoring of vendor security posture using automated scanning and attestation tools.
Negotiate contractual clauses for breach notification timelines, audit rights, and liability allocation.
Assess software bill of materials (SBOMs) for open-source and third-party components in critical applications.
Enforce secure development practices in vendor SDLC through code review and penetration testing requirements.
Map interdependencies in the supply chain to identify single points of failure or cascading risk.
Conduct on-site assessments for high-risk suppliers with access to core operational technology (OT) systems.

Module 6: Cybersecurity Metrics and Performance Monitoring

Select KPIs and KRIs that align with business objectives, such as mean time to detect (MTTD) or patch latency.
Define baseline thresholds for metrics and establish variance reporting for executive dashboards.
Integrate security telemetry into enterprise data warehouses for cross-functional reporting.
Balance leading indicators (e.g., training completion) with lagging indicators (e.g., incident count).
Validate metric accuracy by cross-referencing data sources (e.g., SIEM vs. ticketing system).
Adjust metrics based on organizational changes, such as cloud migration or M&A activity.
Use benchmarking against peer organizations cautiously, accounting for differences in scale and sector.
Report control drift to governance bodies when metrics consistently fall outside acceptable ranges.

Module 7: Regulatory Compliance and Audit Management

Map control requirements across overlapping regulations to avoid redundant implementation efforts.
Develop audit evidence repositories with version control and access logging for compliance artifacts.
Coordinate internal and external audit schedules to minimize operational disruption.
Respond to audit findings with remediation plans that include root cause analysis and timelines.
Prepare for regulatory examinations by conducting mock audits with independent teams.
Document compensating controls when full compliance is not immediately feasible.
Track regulatory changes through legal monitoring services and assess impact on existing controls.
Establish data retention and deletion policies that satisfy both compliance and privacy obligations.

Module 8: Identity and Access Governance

Implement automated user provisioning and deprovisioning workflows across hybrid environments.
Conduct periodic access reviews for privileged and sensitive roles with manager attestation.
Enforce separation of duties (SoD) rules to prevent conflicts in financial and operational systems.
Integrate privileged access management (PAM) for just-in-time elevation and session monitoring.
Monitor for anomalous access patterns using UEBA integrated with identity providers.
Standardize identity attributes across directories to support consistent policy enforcement.
Define lifecycle stages for service accounts and enforce rotation and credential management.
Respond to orphaned accounts or dormant privileges identified during access certification cycles.

Module 9: Cybersecurity Budgeting and Resource Allocation

Develop multi-year cybersecurity investment plans aligned with enterprise technology roadmaps.
Justify capital versus operational expenditures for security tools based on depreciation and scalability.
Allocate budget across prevention, detection, response, and resilience capabilities using risk-based weighting.
Negotiate enterprise licensing agreements to reduce per-unit costs across global operations.
Assess outsourcing versus in-house staffing for functions like SOC operations or vulnerability management.
Track resource utilization to identify skill gaps and plan for training or hiring.
Re-baseline budgets annually based on threat landscape changes and incident trends.
Present cost-benefit analyses for major initiatives, such as cloud security transformation or Zero Trust adoption.

Module 10: Cyber Resilience and Business Continuity Integration

Align recovery time objectives (RTO) and recovery point objectives (RPO) with business impact analysis outcomes.
Test backup integrity and restoration procedures for critical systems at least quarterly.
Integrate cyber incident scenarios into enterprise business continuity and disaster recovery (BC/DR) plans.
Ensure offline backups and air-gapped systems are available for ransomware recovery.
Validate communication trees and alternate coordination channels during simulated outages.
Coordinate with physical security teams to manage access during cyber-physical incidents.
Update crisis management playbooks to include cyber-specific roles and decision gates.
Conduct full-scale cyber resilience exercises involving executive leadership and external partners.