Course Outline
The curriculum encompasses training objectives, detailed module descriptions with allocated learning hours, and recommended reference materials:
Current syllabus documentation (PDF)
Summary of curriculum structure:
1. Information Risk Management Concepts and Frameworks
- The operational necessity for information risk management within the information lifecycle
- The organizational context of risk governance
2. Foundational Principles of Information Risk Management
- Core principles of information security
- Confidentiality, integrity, and availability (CIA) triad
- Accountability, nonrepudiation, authenticity, privacy, secrecy, identification, resilience, and reliability
- Differentiation among information security, cybersecurity, information risk management, and information assurance
- Standards for information risk management and established best practice guidelines
- Information risk management processes
- The four-stage information risk management process, including context establishment; risk assessment (encompassing risk identification, analysis, evaluation, and treatment); communication and consultation; and monitoring and review
- Risk management methodologies applicable for government operations
- Information risk terminology and definitions
- Definitions of threats, hazards, vulnerabilities, proximity, likelihood, probability, and risk.
- Strategic risk treatment options, including risk avoidance or termination; risk reduction or modification; risk transference or sharing; risk acceptance or tolerance; and risk retention
3. Implementation of an Information Risk Management Programme
- Requirements for an effective information risk management programme
- The Plan-Do-Check-Act model, also referred to as the Deming Cycle
- Development of a strategic approach to information risk management
- Principles governing information classification
4. Risk Identification
- Processes for identifying information assets, both tangible and intangible
- Execution of business impact analysis
- Conduct of threat and vulnerability assessments
5. Risk Assessment
- Execution of risk analysis
- Differentiation between, and appropriate application of, qualitative, quantitative, and semi-qualitative risk analysis
- Differentiation between generic and specific risk analyses
- Construction and application of risk matrices
- Conduct of risk evaluation
6. Risk Treatment
- Explanation of risk treatment options, controls, and processes
- The four strategic risk treatment options: risk avoidance or termination; risk reduction or modification; risk transference or sharing; risk acceptance or toleration; and risk retention
- Purpose of tactical risk treatment controls, including prevention; detection; correction; direction; elimination; impact minimization, monitoring and awareness; deterrence; and recovery
- The three categories of operational risk treatment controls: procedural/human; physical/environmental; and technical/logical
- Explanation of the application of a risk treatment plan
7. Monitoring and Review
- Explanation of information risk monitoring mechanisms
- Execution of information risk reviews
8. Risk Reporting and Business Case Presentation
- Reporting and presenting the progress of a risk management programme
- Presentation of a business case
NobleProg is an Accredited Training Provider for BCS.
This course will be delivered by an expert NobleProg instructor approved by BCS.
The fee includes delivery of the complete course syllabus by an approved BCS instructor and the BCS CIRM examination (which may be taken remotely at the candidate's convenience and is centrally proctored by BCS). Subject to successful completion of the examination (a multiple-choice format requiring a minimum score of 65% to pass), participants will hold the accredited BCS Practitioner Certificate in Information Risk Management (CIRM).
Requirements
While there are no formal entry requirements, participants are expected to possess a foundational understanding of information assurance.
It is advantageous for candidates to have knowledge of regulations impacting information risk management, such as data protection or freedom of information legislation. This qualification is designed for Information Risk Managers and individuals responsible for information governance within both the public and private sectors for government and other entities.
Testimonials (4)
Really enjoyed the topics covered and the way that the trainer ran the session
Richard
Course - BCS Practitioner Certificate in Data Protection
The trainer was helpful..
Attila - Lifial
Course - Compliance and the Management of Compliance Risk
1. The BCS test exam questions were often incoherent or not related to the syllabus - which appears to be a trait of BCS course and exams 2. the subject matter was taught reading powerpoint slides full of text - the BCS should be providing at least some diagrammatic content and other visual aids especially as many people learn in very different ways - more than just reading text.
john - UKHO
Course - BCS Practitioner Certificate in Information Assurance Architecture (CIAA)
Speed of response and communication