Course Outline

The syllabus includes training objectives, details of modules and learning hours, plus a recommended reading list:

The latest syllabus (PDF)

Summary outline:

1. The Concepts and Framework of Information Risk Management

  • The necessity for information risk management within the lifecycle of information
  • The organizational context of risk

2. Fundamentals of Information Risk Management

  • Key principles of information security
    • Confidentiality, integrity, availability (CIA)
    • Accountability, nonrepudiation, authenticity, privacy, secrecy, identification, resilience, and reliability
    • Differentiating between information security, cyber security, information risk management, and information assurance
  • Standards and best practices for information risk management
  • The process of information risk management
    • The four stages: context establishment; risk assessment (risk identification, analysis, evaluation, and treatment); communication and consultation; monitoring and review
    • Risk management methodologies
  • Information risk terminology
    • Definitions of threats, hazards, vulnerabilities, proximity, likelihood, probability, and risk
    • Strategic options for risk treatment: avoidance or termination; reduction or modification; transference or sharing; acceptance or tolerance; retention

3. Establishing an Information Risk Management Program

  • Requirements for an information risk management program
    • The Plan-Do-Check-Act model (Deming Cycle)
  • Developing a strategic approach to information risk management
  • Principles of information classification

4. Risk Identification

  • Process for identifying information assets (tangible and intangible)
  • Conduct a business impact analysis
  • Perform a threat and vulnerability assessment

5. Risk Assessment

  • Conduct a risk analysis
    • Differences between qualitative, quantitative, and semi-qualitative risk analyses and their appropriate use
    • Differentiating between generic and specific risk analyses
    • Constructing and using a risk matrix
  • Conduct risk evaluation

6. Risk Treatment

  • Explain risk treatment options, controls, and processes
    • Strategic options: avoidance or termination; reduction or modification; transference or sharing; acceptance or tolerance; retention
    • Tactical controls: prevention; detection; correction; direction; elimination; impact minimization, monitoring, awareness, deterrence, recovery
    • Operational controls: procedural/people; physical/environmental; technical/logical
  • Explain the use of a risk treatment plan

7. Monitoring and Review

  • Explain information risk monitoring
  • Conduct an information risk review

8. Presenting Risks and Business Case

  • Report and present the progress of a risk management program
  • Present a business case

Govtra is a BCS Accredited Training Provider.

This course will be delivered by an expert Govtra trainer approved by BCS.

The price includes delivery of the full course syllabus by an approved BCS trainer and the BCS CIRM exam (which can be taken remotely at your convenience and is centrally invigilated by BCS). Subject to successfully passing the exam (multiple choice, requiring a score of at least 65% to pass), participants will hold the accredited BCS Practitioner Certificate in Information Risk Management (CIRM) for government.

Requirements

There are no formal entry requirements; however, participants should possess an understanding of information assurance.

It will be beneficial for candidates to have knowledge of laws impacting information risk management, such as the Data Protection Act or Freedom of Information Act. This qualification is designed for government Information Risk Managers and all individuals responsible for managing information, both in the public and private sectors for government.

 35 Hours

Number of participants


Price per participant

Testimonials (5)

Upcoming Courses

Related Categories