ISTS4103 - Security Policy and Management
Overview
This course introduces the principles and practices of security policy and information security management. Students learn how organizations establish security governance, define roles and responsibilities, classify information assets, manage risk, develop security policies and standards, align controls with regulations and frameworks, and sustain security operations through monitoring, awareness, audit, and continuous improvement. The curriculum covers security governance, risk appetite, policy hierarchy, acceptable use, access management, data protection, incident response governance, business continuity, third-party risk, compliance, privacy, ethics, awareness programs, metrics, audit readiness, and security management frameworks such as ISO/IEC 27001, ISO/IEC 27002, NIST Cybersecurity Framework, and NIST Risk Management Framework. Through a semester-long project, students produce a professional and defensible security management portfolio for a realistic organizational case.
Pre-requisites:
Learning Hours Composition:
- 42 hours face to face, consisting of 14 sessions of lecturing, tutorial or workshop.
- 28 hours of Structured Learning and Guided Group Discussions
- 65 hours of Independent, Project-Based Learning
Managing Faculty:
Credit Point:
3 Credit(s)
Learning Hours:
45 hours x 3 CPs = 135 hours
