Program facts
- Study fee
- Free
- subjects
- 5
- lessons
- 20
- Estimated time
- 12.5 hours
- Access period
- 60 days
- Study language
- Arabic and English
About the program
The program builds a shared language for managers, operations staff, procurement teams, HR professionals, project teams, and digital functions that take part in cybersecurity decisions. It starts with assets, threats, vulnerabilities, and business impact, then moves through governance and risk assessment, identity and system protection, phishing and human factors, detection, incident response and recovery, supplier risk, digital services, and control effectiveness. Learners work with country-neutral fictional organizations and scenarios so they can explain why a control or escalation decision is appropriate. The program does not teach exploitation, bypass techniques, or offensive operations. It is a structured foundation and does not require advanced technical experience.
Practical relevance
Learners practice prioritizing simplified risks, reviewing access logic, selecting protective measures, verifying suspicious requests, choosing reporting and escalation paths, thinking through restoration priorities, asking suppliers security questions, and interpreting control indicators for management decisions.
Why this program
Cybersecurity is not only a technology-team concern. Buying a cloud service, granting access, responding to a suspicious request, maintaining backups, and engaging a supplier are business decisions that can change risk. The program therefore focuses on the relationship among risk, controls, accountability, and measurement, helping non-specialists make better decisions and collaborate productively with security and technology specialists.
Career relevance
The program is useful for professionals who work with risk, operations, procurement, projects, digital transformation, or management oversight and need a structured foundation for communicating with security and technology teams. It does not replace advanced technical training, professional certification, or specialized experience.
What you will learn
- Translate assets, threats, and vulnerabilities into an understandable picture of business cyber risk.
- Use governance and the NIST CSF 2.0 functions to organize responsibilities and priorities.
- Assess simplified cyber risks and choose proportionate treatments.
- Apply identity, access, multi-factor authentication, and least-privilege principles.
- Select appropriate controls for data, systems, backups, and patching.
- Recognize phishing and social engineering and apply verification, reporting, and awareness practices.
- Understand basic detection, escalation, incident response, and recovery.
- Evaluate supplier and digital-service risks and measure control effectiveness and improvement priorities.
Learning outcomes (10)
- Explain cybersecurity as a business risk and connect assets, threats, vulnerabilities, and controls to operational, financial, and reputational impacts.
- Apply governance principles, roles, and the NIST CSF 2.0 functions to a fictional organization to clarify responsibilities and decisions.
- Assess simplified cyber risks using likelihood and impact, prioritize them, and select an appropriate risk treatment.
- Apply identity and access management principles, including account lifecycle, least privilege, and multi-factor authentication, in business situations.
- Select appropriate controls for protecting data and systems, including data handling, secure configuration, patching, backup, and restore testing.
- Recognize phishing and social-engineering indicators and apply verification, reporting, and awareness practices that reduce human-factor risk.
- Interpret basic detection evidence such as logs and alerts in a business context and determine when escalation is needed without performing offensive activity.
- Apply incident preparation, response, and recovery principles, including roles, communications, restoration priorities, and post-incident learning.
- Evaluate supplier, third-party, and digital-service risks and set proportionate security requirements and monitoring.
- Measure the effectiveness of selected controls, prioritize gaps, and build an improvement roadmap and management-friendly reporting.
Who it is for
- Learners and professionals seeking a structured foundation in Cybersecurity for Business.
- People seeking applicable knowledge without requiring advanced prior experience.
What it does not offer
- Penetration testing, exploitation, or instruction for bypassing security controls.
- Advanced security-operations or digital-forensics role preparation.
- Jurisdiction-specific cybersecurity law or compliance interpretation.
Curriculum
- Subject 1 Open for free
Cybersecurity as Business Risk and Governance
This subject builds an applied foundation in Cybersecurity as Business Risk and Governance, connecting concepts to business decisions and safe defensive scenarios.
- Subject 2
Protecting Identity, Access, Data, and Systems
This subject builds an applied foundation in Protecting Identity, Access, Data, and Systems, connecting concepts to business decisions and safe defensive scenarios.
- Subject 3
Phishing, Human Factors, Awareness, and Detection
This subject builds an applied foundation in Phishing, Human Factors, Awareness, and Detection, connecting concepts to business decisions and safe defensive scenarios.
- Subject 4
Incident Response, Continuity, and Recovery
This subject builds an applied foundation in Incident Response, Continuity, and Recovery, connecting concepts to business decisions and safe defensive scenarios.
- Subject 5
Supplier Risk, Digital Services, and Cybersecurity Improvement
This subject builds an applied foundation in Supplier Risk, Digital Services, and Cybersecurity Improvement, connecting concepts to business decisions and safe defensive scenarios.
Subjects unlock in sequence as you progress.
Strengths
- A business-first view that connects cybersecurity to decisions, risk, and continuity rather than reducing it to tools.
- Clear use of recent primary sources from NIST and CISA, plus OWASP where relevant.
- Defensive, safe application that teaches prevention, detection, and response without harmful offensive procedures.
- Five progressive subjects that connect governance, protection, human factors, incidents, and supplier risk.
- Bilingual learning with country-neutral examples and questions focused on understanding and application.
Evidence basis
The curriculum design draws on NIST CSF 2.0 and NIST guidance for digital identity, phishing, incident response, and supply-chain risk, with CISA Cybersecurity Performance Goals and the OWASP Top 10 used where they add practical context. Sources are used only within the recorded access scope, and the teaching, cases, and questions are original.
Reference organizations
- NIST
- CISA
- OWASP Foundation
Frameworks used
- CISA Cross-Sector Cybersecurity Performance Goals
- OWASP Top 10 — 2025
Methodology
Primary sources were reviewed first, then outcomes, subjects, lessons, and assessments were designed to progress from business-risk understanding to applied defensive controls and decisions.
How the route works
Short Diplomas are relatively comprehensive learning pathways that cover a major subject through five connected learning subjects and structured assessments, with a diploma transcript available with the credential.
Self-paced sequential study. Content unlocks progressively and each subject combines reading, examples, exercises, knowledge checks, and assessment.
- Build integrated knowledge in a major subject.
- Study through five clear, connected learning subjects.
- Complete a defined assessment for each subject.
- Receive a diploma transcript showing subjects and results when the credential is issued.
Assessment
Each Short Diploma contains five subjects, each with an approved assessment. A sixth final exam is not required when the five assessments adequately cover the learning outcomes.
Assessment attempts: 2 per assessment, 7 days apart
The pass mark is announced before the program is published.
Certificate
Successful completion makes the learner eligible for the Short Diploma certificate and Diploma Transcript under the credential policy.
Every certificate has a public verification code. Verify a certificate
Disclaimer: Training completion, not a university degree or professional cybersecurity licence.
Program questions
Do I need an advanced technical background?
No. This is a business-focused foundation and important terms are introduced before they are used heavily. General familiarity with workplace systems is useful, but programming or prior security experience is not required.
Will the program teach hacking or penetration testing?
No. The scope is defensive and business-oriented: governance, risk, identity, phishing, backups, detection, incidents, suppliers, and control measurement, without exploit or security-bypass procedures.
Is the program based on only one framework?
NIST CSF 2.0 is a principal organizing framework, supported by more specific NIST guidance, CISA material, and OWASP where useful. The goal is decision logic, not memorizing a single document.
Does it cover cybersecurity law for a specific country?
No. The program is country-neutral and does not assume a national legal regime. Practical use in a regulated environment requires checking the applicable local requirements from authoritative sources.
How is learning assessed?
Each lesson has a small knowledge check, and each of the five subjects has its own summative assessment. A central learner passing percentage is not invented during authoring when the master policy leaves it unresolved.
Will I learn to handle a real cyber incident?
You will learn the logic of preparation, escalation, coordination, communication, and recovery through safe scenarios. The program does not claim advanced digital-forensics or specialist incident-response qualification.