Policies Development Masterclass – Build, Govern, Implement

Discover how governance committees align IT and security strategies with business goals via IT strategy, IT steering, project steering, and security steering committees, guiding investments and roadmaps.

Identify and align security goals and objectives with business strategy to protect confidentiality, integrity, and availability, using risk management and metrics to drive a security program.

Navigate legal, physical, ethical, and cultural constraints that shape security strategy, including PCI, SOX, GDPR, and disaster recovery, while aligning cost, structure, and culture to ensure compliant, resilient implementations.

Navigate common biases and pitfalls in security strategy development, including overconfidence, optimism bias, and groupthink, by using objective maturity models, diverse feedback, and value-focused planning.

Explore governance tools like policies, standards, and procedures that set the strategic direction for information security, approved by senior management and communicated with clear, high-level, general guidelines.

Develop concise, usable security policies with clear scope, defined roles, and enforceable penalties, then implement, train, and regularly review them to align with legal standards.

Learn how to develop information security and technology control policies for multinational organizations, using ISO, NIST, Cobit, and CIS references, and compare top-down, bottom-up, and baseline policy approaches.

Define and enforce the AUP, clear desk policy, and physical security guidelines to protect assets, data, and organizational reputation through access controls, monitoring, and regular audits.

Explore network access, wireless access, and BYOD policies. Define device authentication, approvals, and WPA2/WPA3 encryption to safeguard corporate resources.

Examine how standards and baselines shape information security by turning policies into measurable requirements and mandatory controls. Compare standards and baselines with examples like password requirements and TLS updates.

Explore the differences between narrow AI, AGI, and super AI, with examples like Siri, Alexa, and RankBrain, and discuss their capabilities, limits, and future implications.

Develop a structured generative AI strategy by identifying business objectives, assessing readiness, defining use cases, securing executive buy-in, implementing plans, building a skilled team, and establishing governance and data practices.

Explore how front end, back end, and database layers communicate via HTTP requests and SQL queries, and how default Apache credentials threaten confidentiality, integrity, and availability.

Explore threats, assets, and vulnerabilities, and how confidentiality, integrity, and availability shape security. Learn how CVE IDs, Cvss scores, zero-day vulnerabilities, and exploitation affect risk, detection, and patching.

Protect information from unauthorized access by achieving confidentiality, integrity, and availability through technical and non-technical controls. Implement firewalls, antivirus, and security awareness training to support authenticity and non-repudiation.

Uncover the cyber attack cycle by showing how threat actors exploit vulnerabilities, reverse engineer patches, and use Shodan io and exploit databases to target systems.

Explore how security controls prevent, detect, deter, and correct to protect assets, balance cost with asset value, and demonstrate return on security investment through resilience and continuity.

Explore IT general controls and how they support data security, application controls, and IT governance through detective, preventive, deterrent, and corrective measures such as SIEM, IDS, and backups.

Evaluate controls to mitigate risks, detect issues, and identify compensating controls; use ISO 12,000, ISO 27,001, and ISO 9001 to shape audit risk–aware checklists.

Identify IT and compliance risks by inventorying assets with classification, analyzing threats, and using top-down or bottom-up risk scenarios to guide risk assessment, treatment, and continuous monitoring.

Analyze IT and compliance risks by evaluating impact and likelihood to prioritize mitigation. Compare subjective, objective, and semi-quantitative approaches and apply techniques like bowtie analysis to reveal interdependencies.

Evaluate risks against predefined criteria to prioritize treatment, then apply elimination, avoidance, mitigation, transfer, or acceptance aligned with the organization’s risk appetite and objectives.

Explore key risk management frameworks, including ISO 31,000, ISO 27,005, the Nest cybersecurity framework, COSO, the ISACA risk framework, and the NIST RMF with six steps.

Explore the COSO enterprise risk management framework and its five components, aligning governance, strategy, and performance to create value. Use tools like risk registers and dashboards to manage risk.

Explore ISO 31000's risk management principles, framework, and process, and learn how ISO 27005 guides information security risk within an ISMS aligned to ISO 27001.

Bridge your current security posture to the desired state through a structured gap analysis that aligns with regulatory requirements, defines the target state, and closes gaps with an action plan.

Explore major federal laws and acts, including the computer fraud and abuse act (cfaa) and Nepa, Sarbanes-Oxley, and the Hitech act, detailing unauthorized access, penalties, privacy, and health information exchange.

Examine CALEA and Fisma frameworks, including the cyber security enhancements and identity theft provisions, and explore Itar and Ihr export controls for effective compliance and risk management.

Explore core privacy concepts, data subject rights, and regulatory frameworks such as general data protection regulation (gdpr), hipaa, and ccpa, plus roles like data controller, data processor, and dpo.

Explore how a robust data governance framework unifies policies, roles, controls, and assessments to protect data, ensure privacy compliance, and enable transparent reporting.

Master data governance tools to build a complete inventory of personal data, ensure accuracy and privacy compliance, and manage data flow with data flow diagrams (DFDs) and metadata repositories.

Explore how privacy documentation, controls, and governance structures support data use limitation, data subject rights under GDPR, and e-discovery to protect personal information and build trust.

Explore information system auditing as formal testing to verify compliance with laws, governance, and policies, while safeguarding confidentiality, integrity, and availability through risk-based controls and audits.

Plan, execute, and report audits by collecting evidence and evaluating controls. Apply project management, address legal and regulatory requirements, and deliver a compliant audit report with follow-up.

Explore how regulatory compliance shapes the audit function, differentiate standards from regulations, and support management decisions based on risk assessments to meet laws like Sox, GDPR, HIPAA, and PCI DSS.

Explore how artificial intelligence accelerates auditing by applying document classification, text summarization, search and retrieval, statistical analysis, and sentiment analysis to streamline planning, fieldwork, and reporting.

Explore how metrics reveal process health and security culture, guiding change and risk management through KGIs, CSFs, KPIs, KCIs, and CRIs toward strategic governance.

Explore how gap assessment drives security maturity and how maturity models guide planning, implementation, and continuous improvement of controls through frameworks like CMMi, ITIL, and Cybersecurity Capability Maturity Model.

Explore how to implement a robust user account policy, a strong password policy, and a comprehensive user access control policy to secure accounts and enforce least privilege.

Explore internet access, email security, and remote access policies to safeguard organizational networks. Assess policy strategies: promiscuous, permissive, paranoid, prudent, and key controls, encryption, monitoring, and remote access methods.

Explore how server policy, software application security policy, and data backup policy interconnect to secure servers, applications, and data through restricted access, data validation, encryption, logging, and disaster recovery.

Explore the essential elements of a business continuity policy, including risk assessment, roles, recovery strategies, rpo and rto targets, and testing, to safeguard operations during disruptions.

Explore the essential components of an HR policy, from recruitment and terms to conduct, performance, health and safety, and leave policies, with emphasis on legal compliance and clarity.