Security and Risk Management
CISSP Domain 1 in depth: the five pillars and design principles, governance, roles and due care, ISO 27001, NIST CSF 2.0, the RMF and other frameworks, cybercrime, intellectual property and export controls, PIPEDA, Law 25 and cross-border transfers, compliance, SOC reports and investigations, ethics, policy, business impact analysis, personnel and supply chain security, quantitative and qualitative risk analysis, threat modelling and awareness, with a capstone risk assessment.
CISSP-110 12 lessons · 5 h 19 min
Offered by HSM University · CISSP Exam Prep
This is the Canadian version of this course. See the American version.
What you'll learn
- Explain the five pillars of information security and apply core design principles such as least privilege, separation of duties and defence in depth
- Distinguish governance from management, assign security roles and accountability, and explain due care, due diligence and board reporting
- Compare ISO/IEC 27001 and 27002, NIST CSF 2.0, the NIST RMF and SP 800-53, COBIT, SABSA, ISO 31000, FAIR, PCI DSS and government frameworks
- Distinguish criminal, civil and administrative law and explain cybercrime, intellectual property, licensing and export control issues in security
- Apply privacy principles, breach notification rules and transborder data transfer mechanisms in domestic and international contexts
- Manage compliance obligations from law, contracts and standards, interpret SOC reports and SLAs, and distinguish the five investigation types
- Apply the ISC2 Code of Ethics and organizational codes of conduct to professional dilemmas, including reporting concerns
- Develop and maintain policies, standards, baselines, procedures and guidelines, including exception processes
- Conduct a business impact analysis and set MTD, RTO, RPO and WRT, including external dependencies, and choose recovery strategies
- Apply personnel security controls across the employment life cycle and manage supply chain risk with tiering, contracts and SBOMs
- Assess risk qualitatively and quantitatively using SLE, ARO and ALE, choose risk responses and classify and assess controls
- Use threat modelling methods such as STRIDE and PASTA, design and measure awareness programs, and complete an enterprise risk assessment
Course content
12 lessons · 5 h 19 min total · final exam
- 1 Security concepts: the five pillars and core principles 27 min · quiz
- 2 Security governance: alignment, roles and due care 27 min · quiz
- 3 Security control frameworks and risk frameworks 24 min · quiz
- 4 Cybercrime, intellectual property and export controls in Canada and abroad 26 min · quiz
- 5 Privacy law and transborder data flows in Canada 27 min · quiz
- 6 Compliance, contracts and investigation types 26 min · quiz
- 7 Professional and organizational ethics 27 min · quiz
- 8 Policies, standards, procedures and guidelines 27 min · quiz
- 9 Business continuity and business impact analysis 26 min · quiz
- 10 Personnel security and supply chain risk management 27 min · quiz
- 11 Risk management: assessment, treatment, controls and monitoring 28 min · quiz
- 12 Threat modelling, security awareness and capstone risk assessment 27 min · quiz
- E Final exam 20 questions
Requirements
Recommended background. You can start any course at any time.
Description
CISSP Domain 1 in depth: the five pillars and design principles, governance, roles and due care, ISO 27001, NIST CSF 2.0, the RMF and other frameworks, cybercrime, intellectual property and export controls, PIPEDA, Law 25 and cross-border transfers, compliance, SOC reports and investigations, ethics, policy, business impact analysis, personnel and supply chain security, quantitative and qualitative risk analysis, threat modelling and awareness, with a capstone risk assessment.