Get in Touch

Course Outline

The syllabus covers training objectives, module details, learning hours, and a recommended reading list:

The latest syllabus (PDF)

Summary outline:

1. Concepts and framework of information risk management

  • The necessity of information risk management (the information lifecycle)
  • The context of risk within organisations

2. Information risk management fundamentals

  • Information security fundamentals
    • Confidentiality, integrity, and availability (CIA)
    • Accountability, non-repudiation, authenticity, privacy, secrecy, identification, resilience, and reliability
    • Distinctions between information security, cyber security, information risk management, and information assurance
  • Standards and good practice guides for information risk management
  • The information risk management process
    • The four stages: establishing context, risk assessment (identification, analysis, evaluation, and treatment), communication and consultation, and monitoring and review
    • Risk management methodologies
  • Terminology and definitions
    • Definitions for threats, hazards, vulnerabilities, proximity, likelihood, probability, and risk
    • Strategic risk treatment options, including avoidance or termination, reduction or modification, transference or sharing, acceptance or tolerance, and retention

3. Establishing an information risk management programme

  • Requirements for an information risk management programme
    • The Plan-Do-Check-Act model, also known as the Deming Cycle
  • Developing a strategic approach to information risk management
  • Principles of information classification

4. Risk identification

  • Process for identifying information assets (tangible and intangible)
  • Conducting a business impact analysis
  • Conducting a threat and vulnerability assessment

5. Risk assessment

  • Undertaking risk analysis
    • Differences and appropriate use of qualitative, quantitative, and semi-qualitative risk analysis
    • Differences between generic and specific risk analyses
    • Construction and use of a risk matrix
  • Conducting risk evaluation

6. Risk treatment

  • Explaining risk treatment options, controls, and processes
    • The four strategic risk treatment options: risk avoidance or termination, reduction or modification, transference or sharing, acceptance or toleration, and retention
    • Tactical risk treatment controls: prevention, detection, correction, direction, elimination, impact minimisation, monitoring and awareness, deterrence, and recovery
    • Three types of operational risk treatment controls: procedural/people, physical/environmental, and technical/logical
  • Explaining the use of a risk treatment plan

7. Monitor and review

  • Explaining information risk monitoring
  • Undertaking an information risk review

8. Presenting risks and business case

  • Reporting and presenting the progress of a risk management programme
  • Presenting a business case

NobleProg is a BCS Accredited Training Provider.

This course is delivered by an expert NobleProg trainer approved by BCS.

The price includes delivery of the full course syllabus by an approved BCS trainer and the BCS CIRM exam (which can be taken remotely at your convenience and is centrally invigilated by BCS). Upon successfully passing the exam (multiple choice, requiring a score of at least 65%), participants will receive the accredited BCS Practitioner Certificate in Information Risk Management (CIRM).

Requirements

While there are no formal entry requirements, delegates must possess a working knowledge of information assurance.

It is beneficial for candidates to understand legislation impacting information risk management, such as Data Protection or Freedom of Information regulations. This qualification is designed for Information Risk Managers and anyone responsible for managing information in either the public or private sector.

 35 Hours

Testimonials (4)

Related Categories