Cybersecurity Policies and Frameworks

This learning module introduces learners to the principles, structure, and practical application of cybersecurity policies and frameworks in organisational environments. It begins by examining how cybersecurity policies are developed, what makes them effective, and how they support security governance, legal compliance, and day-to-day security operations. Learners explore key policy components, the importance of clear and enforceable rules, and the relationship between organisational requirements, technical controls, and user responsibilities.

The module then presents the major cybersecurity standards and frameworks used at international, regional, and sectoral level. It examines how standards such as ISO and NIST support governance, risk management, and compliance, and how these frameworks are applied to areas such as data protection, cloud services, and sector-specific regulation. The module also addresses cybersecurity in the supply chain, helping learners understand supplier relationships, transparency, traceability, and the controls needed to protect software, hardware, and service integrity across interconnected environments.

In addition, the module introduces Information Security Management Systems (ISMS) and the role of ISO/IEC 27001 in establishing, maintaining, and improving information security practices. It also explores process improvement and quality management through reference models, assessment models, and maturity models. By the end of the module, learners will be able to explain key policy and framework concepts, identify relevant standards, understand supply chain security responsibilities, and relate structured management and improvement processes to stronger cybersecurity outcomes.