1 – Introduction to the Course
2 – Today’s Digital Economy
- What cybersecurity is and why it matters
- The impact of cybersecurity on the economy
- The basic principle of cybersecurity
- Critical infrastructure, vulnerabilities & consequences
- What is PPD-21 (Presidential Policy Directive) and why does it matter?
- The Cyber Kill Chain (CKC) & fundamental cybersecurity principles
- What are threats, vulnerabilities & assets?
- What is the difference between a threat and a vulnerability?
3 – Understanding Cyber Risk
- Understanding and explaining the terms: risk, asset, vulnerability, threat
- Defining measures for handling risks & opportunities
- Establishing the context
- Defining criteria for risk assessment & risk acceptance
- Risk identification
- Analysis & evaluation
- Treatment (including avoidance, modification, sharing & retention)
- Understanding how risks & treatment plans are recorded, documented & managed
4 – Fundamentals of the NIST Cybersecurity Framework
- Understanding the NIST Cybersecurity Framework (NIST CSF)
- Understanding & explaining the objectives of the NIST CSF
5 – Core Functions, Categories & Subcategories
- Understanding & explaining the core functions
- Understanding & explaining the framework categories
- Understanding & explaining the framework subcategories
- Understanding & explaining the informative references
6 – Implementation Tiers
- General understanding of the NIST CSF Implementation Tiers & their use
- Understanding the four NIST CSF Implementation Tiers
- Understanding the three risk categories
7 – Developing Framework Profiles
- General understanding of NIST CSF Profiles & their use
- Understanding how the biggest gaps are identified
- Understanding & demonstrating how profiles are determined using a risk assessment
8 – Improving Cybersecurity
- Understanding the key considerations when building a security programme
- Learning how cybersecurity is integrated into an Information Security Management System (ISMS)
- Understanding how the NIST Risk Management Framework is adopted
- Learning how to build organisational capabilities for continuous cybersecurity improvement
- Understanding the expected adoption of the framework
- Understanding the differences between a rule-based and a risk-based approach
- Knowing the differences between risk assessment & compliance assessment
- Understanding the 7-step process organisations use to create a new cybersecurity programme or improve an existing one
9 – NCSF Controls Factory Model
- Understanding the NCSF Controls Factory Model (CFM)
- Learning how the CFM turns unmanaged assets into managed assets
- Understanding purpose, goals, objectives & key capabilities
- Describing how the NCSF CFM is operationalised
Aimed at IT and cybersecurity professionals seeking certification in operationalising the NIST Cybersecurity Framework (NCSF) across an organisation and its supply chain.
This course introduces the NIST Cybersecurity Framework (NIST CSF). The framework is a risk-based approach to managing cybersecurity risk and consists of three parts: the Framework Core, the Framework Implementation Tiers and the Framework Profiles. Each framework component strengthens the connection between business drivers and cybersecurity activities. The course shows how an organisation can use the framework as a central part of its systematic process for identifying, assessing and managing cybersecurity risk.
