Course Outline
The syllabus outlines training objectives, module details, learning hours, and a recommended reading list:
View the latest syllabus (PDF)
Course Summary:
1. Concepts and Framework of Information Risk Management
- The necessity of information risk management (information lifecycle)
- The context of risk within organisations
2. Fundamentals of Information Risk Management
- Information security fundamentals
- Confidentiality, integrity, and availability (CIA)
- Accountability, non-repudiation, authenticity, privacy, secrecy, identification, resilience, and reliability
- Distinctions between information security, cyber security, information risk management, and information assurance
- Information risk management standards and best practice guides
- The information risk management process
- The four stages: context establishment, risk assessment (identification, analysis, evaluation, and treatment), communication and consultation, and monitoring and review
- Risk management methodologies
- Key terminology and definitions
- Definitions of threats, hazards, vulnerabilities, proximity, likelihood, probability, and risk.
- Strategic risk treatment options: risk avoidance or termination; risk reduction or modification; risk transference or sharing; risk acceptance or tolerance; and risk retention
3. Establishing an Information Risk Management Programme
- Programme requirements
- The Plan-Do-Check-Act model (Deming Cycle)
- Developing a strategic approach to information risk management
- Principles of information classification
4. Risk Identification
- Process for identifying information assets (tangible and intangible)
- Conducting a business impact analysis
- Conducting a threat and vulnerability assessment
5. Risk Assessment
- Performing risk analysis
- Differences and appropriate applications of qualitative, quantitative, and semi-quantitative risk analysis
- Distinctions between generic and specific risk analyses
- Construction and application of a risk matrix
- Conducting risk evaluation
6. Risk Treatment
- Explaining risk treatment options, controls, and processes
- Four strategic risk treatment options: risk avoidance or termination; risk reduction or modification; risk transference or sharing; risk acceptance or toleration; and risk retention
- Purpose of tactical risk treatment controls: prevention, detection, correction, direction, elimination, impact minimisation, monitoring, awareness, deterrence, and recovery
- Three types of operational risk treatment controls: procedural/people, physical/environmental, and technical/logical
- Utilising a risk treatment plan
7. Monitoring and Review
- Understanding information risk monitoring
- Conducting an information risk review
8. Presenting Risks and Business Cases
- Reporting and presenting the progress of a risk management programme
- Presenting a business case
NobleProg is a BCS Accredited Training Provider.
Course delivery is handled by an expert NobleProg trainer approved by BCS.
The fee covers the delivery of the complete course syllabus by an approved BCS trainer and the BCS CIRM exam (available for remote completion at your convenience, with central invigilation by BCS). Upon successfully passing the exam (multiple choice, with a minimum score of 65% required), participants will receive the accredited BCS Practitioner Certificate in Information Risk Management (CIRM).
Requirements
While there are no formal entry requirements, delegates must possess a foundational understanding of information assurance.
It is advantageous for candidates to be familiar with legislation impacting information risk management, such as Data Protection or Freedom of Information regulations. This qualification is tailored for Information Risk Managers and any individuals responsible for managing information in either the public or private sectors.
Testimonials (4)
The trainer was helpful..
Attila - Lifial
Course - Compliance and the Management of Compliance Risk
learning about Basel
Daksha Vallabh - Standard Bank of SA Ltd
Course - Basel III – Certified Basel Professional
Risk optimization is more clear than the other subjects
Munirah Alsahli - GOSI
Course - CGEIT – Certified in the Governance of Enterprise IT
The knowledge and understanding of the trainer on the training material was exceptional. The trainer was well aware of the subject, provided practical examples in relevance. I would highly recommend him as a trainer for this training.