Security+ exam prep: security program management
You learn to build a security programme and explain it to management, from policies and the risk register to supplier reviews and business continuity.
Level 201 · 14 lessons · 12 practice labs
Lessons
Governance and compliance
- Governance documents: policies, standards, procedures, guidelines
- Data roles: owner, controller, processor and custodian
- Compliance and audits: internal, external and their outcomes
- Privacy: the principles personal-data laws share around the world
- Short task: draft an acceptable use policy
Risk management
- Identifying risk: asset, threat, vulnerability, impact
- Quantitative risk: single loss, annual rate and annual loss expectancy
- Keeping a risk register and setting risk appetite
- Supplier risk: contracts, service levels and security questionnaires
- Short task: build a five-risk register and decide on each risk
Awareness and continuity
- A security awareness programme: phishing drills and measurement
- Business continuity and disaster recovery: impact analysis, RTO and RPO
- Running a tabletop exercise
- Capstone: draw up a one-year security programme roadmap for a company
Practice labs
- Sort documents into policy, standard and procedure: You classify twelve document fragments by type and write in one line why each belongs there.
- Fill the gaps in an acceptable use policy: You add remote work, personal device and AI tool clauses to Sedef Kuyumculuk's incomplete acceptable use policy.
- Map data roles onto a process: In a payroll process you identify the owner, controller, processor and custodian and tabulate each role's obligations.
- Calculate annualised loss expectancy: For three threats you calculate single and annualised loss expectancy from asset value, exposure factor and annual rate.
- Is the control worth its cost?: You compare a backup solution's annual cost with the loss it prevents and write a one-page recommendation to management.
- Build a five-risk register: You enter five risks for Akyaprak Belediyesi into a register with likelihood, impact, owner and decision columns and decide each against risk appetite.
- Assess a supplier security questionnaire: You score a cloud supplier's questionnaire answers and write three weak areas and the clause to add to the contract.
- Set RTO and RPO for systems: From business impact data you set acceptable downtime and data loss for four systems and propose a backup frequency.
- Write a tabletop exercise script: You prepare an exercise script for a data-centre flood with timed injects, roles and evaluation questions.
- Interpret phishing drill results: You calculate click, report and credential-entry rates from a drill and identify the two riskiest departments.
- Make a one-quarter awareness plan: Based on drill results you set three months of training topics, audiences and success measures in a plan.
- Prepare an evidence pack for an internal audit: You gather evidence from logs for access review, backup test and patch record controls and report the control that falls short.
About this course
You learn to build a security programme and explain it to management, from policies and the risk register to supplier reviews and business continuity.
What you will learn
- Governance and compliance
- Risk management
- Awareness and continuity
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.