Security management: cyber governance and compliance
Manage an organisation's risks, policies and compliance.
Your running project
A small clinic's security plan
- The need
- Protect patient records on a small budget, and prove it.
- The data
- An asset inventory of a fictional or willing organisation.
- External tools
- ISO/IEC 27001Tableur de risquesModèles de politiques
Workshop
Establish the needs
Who uses it, what problem it solves, how to tell it worked.
What you will learn
- Security management systems and ISO/IEC 27001
- Risk assessment and treatment
- Policies, audits and data protection
- Getting teams to adopt security
Certifications to aim for at the end
- Entry levelISO/IEC 27001 FoundationPECB
- IntermediateISO/IEC 27001 Lead ImplementerPECBThe full title requires five years' experience; Provisional Implementer requires none.
- AdvancedCertified Information Security Manager (CISM)ISACANew exam outline since 3 November 2026.
These certifications are issued by their own bodies, not by Nangmo, and their exams are paid for with them. Checked on 3 November 2026: confirm the language, price and exam location on their site before registering. These exams are generally taken without AI: you will need to read and reason on your own.
How to start a career in this field
- 1Learn security basics and read the structure of ISO/IEC 27001.
- 2Carry out a full risk assessment for a small organisation, and keep it as a sample.
- 3Take the Foundation certification, then Lead Implementer.
- 4Apply as a GRC analyst or junior auditor, at banks, insurers and consultancies.
First jobs to aim for
- Junior GRC analyst
- Junior security auditor
- Compliance officer
The workshop is open, but this path's lessons are not online yet. Tell us you are interested: it helps us decide which to write first.