Certificate
Course Outline
The syllabus encompasses training objectives, detailed module descriptions, allocated learning hours, and a recommended reading list:
View the latest syllabus (PDF)
Summary of the course content:
1. Concepts and framework of information risk management
- The necessity of information risk management within the information lifecycle.
- The context of risk within organisational structures.
2. Fundamentals of information risk management
- The core elements of information security
- Confidentiality, integrity, and availability (CIA).
- Accountability, non-repudiation, authenticity, privacy, secrecy, identification, resilience, and reliability.
- Distinctions between information security, cyber security, information risk management, and information assurance.
- Relevant standards and good practice guides for information risk management.
- The information risk management process
- The four stages of information risk management, which include establishing context; risk assessment (encompassing identification, analysis, evaluation, and treatment); communication and consultation; and monitoring and review.
- Risk management methodologies.
- Information risk terminology and definitions
- Defining terms such as threats, hazards, vulnerabilities, proximity, likelihood, probability, and risk.
- Strategic risk treatment options, including risk avoidance or termination; risk reduction or modification; risk transference or sharing; and risk acceptance, tolerance, or retention.
3. Establishing an information risk management programme
- Requirements for an effective information risk management programme
- The Plan-Do-Check-Act model, commonly referred to as the Deming Cycle.
- Developing a strategic approach to information risk management.
- The principles governing information classification.
4. Risk identification
- The process for identifying information assets, both tangible and intangible.
- Performing a business impact analysis.
- Conducting threat and vulnerability assessments.
5. Risk assessment
- Executing risk analysis
- Differentiating between qualitative, quantitative, and semi-qualitative risk analysis and understanding their appropriate applications.
- Distinguishing between generic and specific risk analyses.
- Constructing and utilising a risk matrix.
- Carrying out risk evaluation.
6. Risk treatment
- Explaining risk treatment options, controls, and processes
- The four strategic risk treatment options: risk avoidance or termination; risk reduction or modification; risk transference or sharing; and risk acceptance, toleration, or retention.
- The purpose of tactical risk treatment controls, including prevention; detection; correction; direction; elimination; impact minimisation; monitoring and awareness; deterrence; and recovery.
- The three categories of operational risk treatment controls: procedural or people-based; physical or environmental; and technical or logical.
- Explaining the application of a risk treatment plan.
7. Monitoring and review
- Explaining the process of information risk monitoring.
- Undertaking an information risk review.
8. Presenting risks and the business case
- Reporting on and presenting the progress of a risk management programme.
- Presenting a robust business case.
NobleProg is a BCS Accredited Training Provider.
This course is delivered by a NobleProg trainer who has been approved by BCS.
The fee covers the delivery of the full course syllabus by an approved BCS trainer, as well as the BCS CIRM examination. The exam can be taken remotely at your convenience and is centrally invigilated by BCS. Upon successfully passing the multiple-choice exam (requiring a minimum score of 65%), participants will be awarded the BCS Practitioner Certificate in Information Risk Management (CIRM).
Requirements
While there are no formal entry requirements, participants are expected to possess a foundational understanding of information assurance.
It is beneficial for candidates to have knowledge of legislation influencing information risk management, such as Data Protection and Freedom of Information regulations. This qualification is specifically designed for Information Risk Managers and professionals responsible for managing information within both the public and private sectors.
Custom Corporate Training
Training solutions designed exclusively for businesses.
- Customised Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
- Flexible Schedule: Dates and times adapted to your team's agenda.
- Format: Online (live), In-company (at your offices), or Hybrid.
Price per private group, online live training, starting from £8000 + VAT*
Contact us for an exact quote and to hear our latest promotions
Testimonials (4)
Really enjoyed the topics covered and the way that the trainer ran the session
Richard
Course - BCS Practitioner Certificate in Data Protection
The trainer was helpful..
Attila - Lifial
Course - Compliance and the Management of Compliance Risk
1. The BCS test exam questions were often incoherent or not related to the syllabus - which appears to be a trait of BCS course and exams 2. the subject matter was taught reading powerpoint slides full of text - the BCS should be providing at least some diagrammatic content and other visual aids especially as many people learn in very different ways - more than just reading text.
john - UKHO
Course - BCS Practitioner Certificate in Information Assurance Architecture (CIAA)
Speed of response and communication
