Course Outline
The syllabus outlines training objectives, module details, learning hours, and includes a recommended reading list:
Summary outline:
1. Concepts and framework of information risk management
- The need for information risk management (information lifecycle)
- The context of risk within organisations
2. Fundamentals of information risk management
- Core principles of information security
- Confidentiality, integrity, availability (CIA)
- Accountability, non-repudiation, authenticity, privacy, secrecy, identification, resilience, and reliability
- Differences between information security, cyber security, information risk management, and information assurance
- Information risk management standards and good practice guides
- The information risk management process
- The four stages: context establishment; risk assessment (including risk identification, analysis, evaluation, and treatment); communication and consultation; and monitoring and review
- Risk management methodologies
- Information risk terminology and definitions
- Meanings of terms such as threats, hazards, vulnerabilities, proximity, likelihood, probability, and risk.
- Strategic risk treatment options, including risk avoidance or termination; risk reduction or modification; risk transference or sharing; risk acceptance or tolerance; and risk retention
3. Establishing an information risk management programme
- Requirements of an information risk management programme
- The Plan-Do-Check-Act model, also known as the Deming Cycle
- Developing a strategic approach to information risk management
- Principles of information classification
4. Risk identification
- Process for identifying information assets (both tangible and intangible)
- Conducting a business impact analysis
- Conducting a threat and vulnerability assessment
5. Risk assessment
- Undertaking risk analysis
- Differences between, and appropriate use of, qualitative, quantitative, and semi-qualitative risk analysis
- Difference between generic and specific risk analyses
- Construction and application of a risk matrix
- Conducting risk evaluation
6. Risk treatment
- Explaining risk treatment options, controls, and processes
- The four strategic risk treatment options: risk avoidance or termination; risk reduction or modification; risk transference or sharing; risk acceptance or toleration; and risk retention
- Purpose of tactical risk treatment controls: prevention; detection; correction; direction; elimination; impact minimisation; monitoring and awareness; deterrence; and recovery
- Three types of operational risk treatment controls: procedural/people; physical/environmental; and technical/logical
- Explaining the use of a risk treatment plan
7. Monitor and review
- Explaining information risk monitoring
- Undertaking an information risk review
8. Presenting risks and building the business case
- Reporting and presenting the progress of a risk management programme
- Presenting a business case
NobleProg is a BCS Accredited Training Provider.
This course will be delivered by an expert NobleProg trainer approved by BCS.
The fee covers delivery of the full course syllabus by an approved BCS trainer and the BCS CIRM exam (which can be taken remotely at your convenience and is centrally invigilated by BCS). Upon successfully passing the exam (multiple choice, requiring a minimum score of 65%), participants will be awarded the accredited BCS Practitioner Certificate in Information Risk Management (CIRM).
Requirements
There are no formal entry requirements; however, delegates should have a basic understanding of information assurance.
It is beneficial for candidates to be familiar with laws affecting information risk management, such as Data Protection or Freedom of Information regulations. This qualification is designed for Information Risk Managers and all professionals responsible for managing information, whether in the public or private sector.
Testimonials (4)
The trainer was helpful..
Attila - Lifial
Course - Compliance and the Management of Compliance Risk
learning about Basel
Daksha Vallabh - Standard Bank of SA Ltd
Course - Basel III – Certified Basel Professional
Speed of response and communication
Bader Bin rubayan - Lean Business Services
Course - ISO/IEC 27001 Lead Implementer
Risk optimization is more clear than the other subjects