Information Security Management aims to provide theoretical and practical knowledge for the evaluation and management of security and related risks in information and communication systems.

As part of the course framework, fundamental concepts and practices that are applied in cybersecurity governance, with a focus on risk management and assessment methodologies, are presented.

The module covers the following subject areas:

• Security governance
• Risk management and assessment methodologies
• Security policy design
• Contingency planning
• Cybersecurity culture development
• Legislative framework and standards

Module content

1. Introduction to Information Security Management concepts
2. Overview of risk management
3. ISO 2700x standards, NIST SP 800-30
4. Risk identification – Threat modelling
5. Risk identification – Vulnerability assessment
6. Risk analysis and evaluation
7. Risk analysis and evaluation
8. Risk treatment
9. OCTAVE Methodology
10. Building a cybersecurity culture
11. Security policies and contingency planning
12. Personal data protection- Legal Framework (I)
13. Personal data protection- Legal Framework (II)
14. Revision