Organisational security, ethics and compliance

44 courses, 767 lessons. A real Kali Linux lab in the browser.

Cybersecurity for everyone (Level 101, 22 lessons): Without any technical background, you learn the core ideas of cybersecurity, common threats and organisational roles, and start spotting risk at work.
Security awareness for employees (Level 101, 25 lessons): You spot phishing, social engineering and risky habits, protect your passwords, devices and company data, and report anything suspicious straight away.
Cyber ethics and law (Level 101, 23 lessons): You learn authorisation, scope, responsible disclosure and cybercrime law through international examples, and make ethical, lawful decisions in your work.
Introduction to GRC (Level 101, 17 lessons): You learn what governance, risk and compliance mean, where rules come from, who is responsible for what in an organisation and what a GRC team does day to day, by working on simple documents.
Introduction to risk management (Level 101, 15 lessons): Through everyday examples you learn to define risk, score likelihood and impact, keep a risk register and choose the right treatment option.
Introduction to privacy: personal data and rights (Level 101, 16 lessons): You learn what personal data is, which rights people have and why organisations are accountable, with GDPR as the model and KVKK, LGPD and CCPA as further examples.
Data protection and privacy (Level 201, 21 lessons): You apply GDPR principles and the KVKK example, and set up data inventory, notices, consent, breach notification and retention processes.
Governance, risk and compliance (GRC) (Level 201, 22 lessons): You assess risk, write policy, map controls to ISO/IEC 27001, NIST CSF 2.0 and CIS Controls, and run internal audits with evidence.
Using AI safely at work (Level 201, 21 lessons): You prevent data leaks, prompt injection and excessive tool permissions in AI tools, and prepare a usage policy that fits your organisation.
Information security in the public sector and critical infrastructure (Level 201, 20 lessons): You apply rules such as NIS2 and national guides, and handle asset classification, secure procurement and incident reporting duties.
Implementing ISO/IEC 27001: building an ISMS (Level 201, 23 lessons): You apply the clauses of ISO/IEC 27001:2022 step by step and build a working ISMS with scope, context, risk assessment, Statement of Applicability, documents, internal audit and management review.
Applying NIST CSF 2.0 (Level 201, 16 lessons): Using the functions, categories, profiles and tiers of the NIST Cybersecurity Framework 2.0, you map an organisation's current and target state and prepare an action plan.
Implementing the CIS Controls (Level 201, 17 lessons): You prioritise the eighteen CIS Controls v8 by implementation group and verify and evidence inventory, configuration, access and logging safeguards on target servers from Kali.
Risk assessment in practice (Level 201, 19 lessons): Using the ISO/IEC 27005 and NIST SP 800-30 approaches you run an asset, threat and vulnerability based risk assessment, write scenarios, evaluate controls and prepare a risk report that drives decisions.
Policy and procedure writing workshop (Level 201, 21 lessons): You write the core documents, from the information security policy to acceptable use, access, password, classification, backup and incident policies, turn them into procedures and manage their lifecycle.
Introduction to IT auditing (Level 201, 17 lessons): You learn the purpose of an audit, design and operating tests, sampling, kinds of evidence, working papers and writing findings, on real evidence files.
Introduction to business continuity and disaster recovery (Level 201, 16 lessons): You learn to understand the business impact of disruption, map critical processes and dependencies, write a simple continuity plan and prove that a backup really restores.
Running a security awareness programme (Level 201, 15 lessons): You analyse audiences and risks, prepare an annual awareness plan and content calendar, design ethical phishing simulations and report behaviour change to management.
Third-party and supply chain risk (Level 301, 20 lessons): You tier suppliers by criticality, assess them with questionnaires and assurance reports, and manage risk through contracts and ongoing monitoring.
Business continuity, disaster recovery and ransomware readiness (Level 301, 20 lessons): You run a business impact analysis, set RTO and RPO, build 3-2-1 backup and recovery plans, and lead ransomware tabletop exercises.
Cybersecurity for leaders (Level 301, 19 lessons): You discuss cyber risk in business terms, set budgets and priorities, report to the board with meaningful metrics and lead well in a crisis.
ISO/IEC 27002 controls in practice (Level 301, 21 lessons): You study the 93 controls of ISO/IEC 27002:2022 across four themes, implement and evidence key controls from each theme on target systems and classify them by attribute.
SOC 2: trust services criteria and audit readiness (Level 301, 18 lessons): You learn the SOC 2 trust services criteria, the difference between Type 1 and Type 2, the system description and the control matrix, prepare a SaaS company for audit with evidence and read a SOC 2 report.
NIS2 and DORA compliance programme (Level 301, 17 lessons): Taking the EU's NIS2 and DORA as the model, you turn scoping, risk management measures, incident reporting, resilience testing and third-party requirements into a compliance programme and compare them with similar rules in other countries.
Quantitative risk analysis: FAIR and Monte Carlo (Level 301, 15 lessons): You use the FAIR model to express risk in money, calibrate expert estimates as ranges and compute loss distributions and return on control investment with Monte Carlo simulation in Python.
ISO/IEC 27001 internal auditing (Level 301, 18 lessons): Following ISO 19011 you plan an ISMS internal audit programme, prepare checklists, interview, gather evidence, grade and write nonconformities and follow up corrective actions.
Auditing IT general controls (ITGC) (Level 301, 16 lessons): You test access, change, IT operations and development controls, extract populations from systems, select samples, evaluate exceptions and write conclusions that financial audits can rely on.
Technical configuration auditing (Level 301, 15 lessons): Using CIS Benchmarks and secure configuration standards you audit Linux servers, databases and network services with tools such as Lynis and OpenSCAP and turn the results into an evidenced compliance report.
GDPR in depth (Level 301, 17 lessons): You study the articles of GDPR, European Data Protection Board guidance and landmark decisions, and apply hard topics such as the legitimate interest test, transfer impact assessments and joint controllership through case studies.
Privacy laws around the world (Level 301, 17 lessons): You compare KVKK, US state laws (CCPA/CPRA), Brazil's LGPD, Canada's PIPEDA, China's PIPL, India's DPDP and others, and build a common privacy baseline for a multi-country organisation.
Incident management governance (Level 301, 16 lessons): You build the governance side of incident response: policy, roles, classification, escalation, legal notification, evidence and records, lessons learned and incident metrics.
Security metrics and reporting (Level 301, 16 lessons): You build the path from goals to metrics, define KPIs and KRIs, collect data from CSV sources and produce automated reports and management dashboards with trends and targets.
Leading an ISO/IEC 27001 project: the road to certification (Level 401, 16 lessons): You lead an ISO/IEC 27001 project end to end: business case, project plan, gap analysis, implementation waves, stage 1 and stage 2 certification audits, surveillance audits and scope extension.
NIST SP 800-53, RMF and multi-framework compliance (Level 401, 16 lessons): You apply the seven steps of the NIST Risk Management Framework and the SP 800-53 control families and baselines, and meet ISO/IEC 27001, CIS Controls, SOC 2 and regulatory requirements at once with a common control library.
Enterprise risk management and cyber risk (Level 401, 15 lessons): With ISO 31000 and COSO ERM you bring cyber risk into the same language as the organisation's other risks and build an integrated programme with a risk appetite statement, risk indicators, scenario analysis and board reporting.
Evidence automation and continuous control monitoring (Level 401, 14 lessons): Instead of gathering control evidence by hand with screenshots, you pull it from systems with scripts, seal it with timestamps and hashes, turn control tests into code and build a continuous compliance dashboard.
Privacy engineering and DPIA in practice (Level 401, 16 lessons): With privacy threat modelling, data flow maps, privacy-enhancing techniques and a thorough data protection impact assessment, you make a new product privacy-compliant at the design stage.
Disaster recovery plans and recovery testing (Level 401, 15 lessons): You write a service's technical recovery plan, carry out restore, failover and failback on target systems and prove RTO and RPO by measuring them.
Scaling a third-party risk programme (Level 401, 13 lessons): You design a programme that manages hundreds of suppliers: risk-based tiering, an automated questionnaire flow, external security ratings, concentration analysis, exit plans and management reporting.
AI governance: ISO/IEC 42001 and the EU AI Act (Level 401, 19 lessons): Taking the EU AI Act as the main example, you classify the AI systems an organisation builds or runs and bring them under governance with an ISO/IEC 42001 management system, impact assessment, data governance, human oversight and a conformity file.
Job role capstone: GRC analyst (Level 401, 12 lessons): You live a quarter as a GRC analyst: a risk register update, a policy review, an access review, a supplier assessment, audit evidence and a management report.
Leading a security programme and strategy (Level 501, 16 lessons): You build a programme from a security leader's view: alignment with business strategy, maturity assessment, a multi-year roadmap, organisation and budget, governance forums, integrated risk and compliance, and accountability to the board.
Job role capstone: IT auditor (Level 501, 12 lessons): As an IT auditor you run a real audit end to end: risk assessment, planning, ITGC and technical tests, data analytics, evidence, findings, the report and a presentation to the audit committee.
Job role capstone: data protection officer (DPO) (Level 501, 12 lessons): You live a year as a data protection officer: keep the record of processing current, answer requests, put new projects through DPIAs, handle a breach, plan training and present an annual report to management.

Projects

Office security walkthrough: clean desk and physical security check: You review photos of a fictional office with a checklist, prioritise exposed information and physical risks, and write a short report.
Build a first risk register for a small office: From Sedirli Hukuk Bürosu's asset list and interview notes, you score twelve risks by likelihood and impact, choose a response for each and write the first risk register.
Personal data request desk: answer five requests: You handle five access, correction and erasure requests sent to Turnalı Perakende: you verify identity, justify your decision and write a reply letter for each one within the deadline.
Phishing drill results report: You break down drill data by department and use click and report rates to present training recommendations to management.
Build a personal data inventory and record of processing: From a fictional company’s interview notes, you record which personal data is held where, why and for how long.
Data breach 72-hour notification drill: In an hour-by-hour breach scenario, you assess the risk and prepare the regulator notice and the message to affected people on time.
ISO/IEC 27001 gap assessment and risk register: You compare a small company’s current practices with the Annex A controls and turn the gaps into a prioritised risk register.
Publish a vulnerability disclosure policy and security.txt: You write a policy explaining how the organisation receives outside vulnerability reports and an RFC 9116-compliant security.txt file.
Quarterly user access review: You compare the HR list with system accounts and send findings on leavers and excess rights to managers for sign-off.
Draft an AI acceptable use policy: For a fictional organisation, you draft a policy covering approved tools, forbidden data, verification rules and how to report problems.
Business impact analysis and a restore test: You work out the business impact analysis for Karaçam Mobilya's order system, set recovery targets, then restore from backup and write a record comparing the time you measured with the target.
Assess a supplier security questionnaire: You review a supplier’s questionnaire answers and evidence, flag inconsistencies and write the remediation asks for conditional approval.
Ransomware tabletop exercise: You prepare a scenario with surprise developments for a hospital, run the exercise and write the after-action improvement plan.
SOC 2 readiness assessment and evidence map: You map Göktaşı Yazılım's control matrix to the trust services criteria, test the evidence on hand and write a readiness report showing the gaps to close before the audit.
NIS2 and DORA: incident classification and the ICT third-party register: You classify six months of Yelkovan Bankası's incident records against the significance criteria, check whether reporting deadlines were met and complete the unfinished ICT third-party register.
IT general controls audit: Linux and PostgreSQL: You test access, change and operations controls on Mavikaya Lojistik's shipping system using evidence you collect from its Linux and PostgreSQL servers, fill in the workpapers and write the findings report.
Quantify ransomware loss with FAIR: You model a ransomware scenario for Demirsu Enerji's billing system with FAIR, run a Monte Carlo simulation and write a management memo comparing two control options by their loss curves.
Data protection impact assessment for an appointment app: You draw the data flow for Lavinya Klinikleri's new appointment app, assess the risks to rights and freedoms, and write an impact assessment with its measures, ready for sign-off.
Disaster recovery failover test between two sites: You fail Kuzeyyıldızı Kargo's tracking app and database over to the second site and back, time each step, verify data loss and write a test report comparing the results with the targets.
A three-year security strategy and board pack: From Selvikent Belediyesi's risk register, audit findings and budget tables, you derive a three-year security strategy, roadmap and set of metrics, and prepare the pack to present to the council.