Consultant Preparation Program in Cybersecurity Governance and Risk

Program facts

Study fee

Free

subjects

5

lessons

20

Estimated time

14 hours

Content last reviewed

21 October 2026

Access period

30 days

Study language

Arabic and English

About the program

An organization can have a security policy, dashboards and supplier reports yet still struggle to answer who may accept risk or whether evidence shows a control working in its critical service. This program begins with a bounded engagement, decision rights, service map and dependencies. It then builds testable threat scenarios, distinguishes facts from assumptions, and estimates likelihood and impact without false precision. Across five modules, learners compare treatments and a constrained portfolio, examine supplier concentration and exceptions, and connect policy, assurance, metrics and incident lessons to oversight. The final advisory case produces a decision memo, staged roadmap, closure evidence and follow-up. Cases are fictional and require no real organizational records. The program teaches reasoning and documentation within an adviser’s role. It grants no license or external accreditation and does not authorize the adviser to decide for an organization. Real application requires checking applicable policy, contract, jurisdiction and qualified specialists.

Practical relevance

Fictional cloud-supplier, payment, privileged-identity and recovery cases produce scenario records, dependency maps, options matrices and monitoring cards. No sensitive records need be uploaded to outside tools.

Why this program

A red risk-register cell or published policy does not explain what changes in a business service. Learners trace an event to consequence, test conflicting evidence, compare faster or cheaper alternatives, and state what would reverse a recommendation. Investment, acceptance of residual risk, and evidence of treatment closure remain distinct.

Career relevance

For experienced security and risk professionals and internal or external advisers who present trade-offs to service owners and committees. It develops evidence review and actionable writing, without promising a protected title, job eligibility or promotion.

What you will learn

• Define engagement scope, decision rights and service dependencies.
• Frame a risk scenario and estimate consequence, likelihood and evidence limits.
• Compare treatments, prioritize a portfolio and document delegated acceptance.
• Test policy, control evidence, measures and incident lessons.
• Present an executive recommendation, gated roadmap and closure card.

Who it is for

• Experienced cybersecurity and risk professionals familiar with digital services and controls.
• Team leaders and advisers who develop recommendations for organizational decision makers.
• Risk, compliance and internal audit managers who take part in cybersecurity decisions and need a shared language with technical teams.

Curriculum

1. Subject 1 Open for free

   Mandate and governance

   Define mandate and decision rights, map service dependencies, test oversight and build current and target CSF outcomes.

   4 lessons · 2 hours

   1. Define the advisory mandate and decision rights 32 min
   2. Map business services and risk context 32 min
   3. Test governance accountability and oversight 32 min
   4. Build current and target CSF profiles 32 min
2. Subject 2

   Risk assessment

   Build defined threat events, separate evidence from assumptions, estimate likelihood and impact, and challenge rankings.

   4 lessons · 2 hours

   1. Construct testable threat scenarios 32 min
   2. Evaluate evidence and uncertainty 32 min
   3. Estimate likelihood and consequence 34 min
   4. Calibrate and challenge risk ratings 32 min
3. Subject 3

   Response and prioritization

   Compare treatment effects and costs, prioritize a constrained portfolio, examine supplier concentration and record delegated acceptance.

   4 lessons · 2 hours

   1. Compare treatment options 32 min
   2. Prioritize a constrained portfolio 32 min
   3. Assess supplier and concentration risk 32 min
   4. Document risk acceptance and escalation 32 min
4. Subject 4

   Operating governance

   Make policy and exceptions operable, connect controls to outcome evidence and oversight measures, and integrate incident lessons.

   4 lessons · 2 hours

   1. Design policy and exception governance 34 min
   2. Connect controls to assurance evidence 32 min
   3. Define metrics and reporting 32 min
   4. Integrate incident lessons and resilience 32 min
5. Subject 5

   Advisory delivery

   Frame an executive decision, resolve stakeholder differences, stage a gated roadmap, and hand over evidence-based follow-up.

   4 lessons · 2 hours

   1. Write an executive risk narrative 34 min
   2. Negotiate recommendations with stakeholders 32 min
   3. Build a sequenced implementation roadmap 34 min
   4. Present, hand over and monitor decisions 34 min

Subjects unlock in sequence as you progress.

Strengths

• Cases contain conflicting evidence and concrete reversal conditions.
• Options are compared under time, budget and dependency limits.
• Recommendations connect authority, closure proof and follow-up.
• Complete Arabic and English instruction includes guided practice.

Evidence basis

Concept instruction uses official NIST publication pages on the CSF, risk management and supply chains with documented reading limits. Teaching cases and numbers are fictional, not empirical study findings or prescribed thresholds. Citation does not imply NIST endorsement.

Assessment

Assessments are aligned to program outcomes and may include module assessments, a final assessment, or a combination, with scenario-based questions where appropriate.

Assessment attempts: 2 per assessment, 7 days apart

The pass mark is announced before the program is published.

Certificate

The credential confirms completion and successful assessment; it does not automatically grant a legal licence to practise as a consultant in a regulated field.

Every certificate has a public verification code. Verify a certificate

Verification example: a real issued certificate

Disclaimer: Educational program for analyzing cybersecurity governance and risk and framing recommendations within role authority. It grants no professional license or external accreditation and does not replace delegated organizational decisions.

Program questions