Risk Management

About This Learning Module

This learning module introduces learners to the principles and practice of cybersecurity risk management. It begins with the core concepts, terminology, and process used to identify, analyse, evaluate, and respond to cybersecurity risks in organisational contexts. Learners explore how assets, threats, vulnerabilities, likelihood, and impact interact, and why risk management is central to cybersecurity governance and decision-making.

The learning module then examines how organisations define risk appetite, tolerance, and evaluation criteria in order to decide which risks are acceptable and which require treatment or escalation. Learners are introduced to key risk indicators, treatment options, mitigation planning, and the selection of appropriate safeguards. The module also explores information security controls and the use of recognised control catalogues, helping learners understand how controls are translated into practical implementation and governance actions.

In addition, the learning module introduces cybersecurity maturity models and their role in measuring capability, guiding improvement, and supporting long-term governance. Through practical examples, scenario-based activities, and assessment tasks, learners develop the ability to explain key risk management concepts, evaluate risks against defined criteria, propose suitable controls and treatment actions, and understand how monitoring and maturity support stronger cybersecurity outcomes.