Cybersecurity Governance, Risk, and Compliance prepares students to manage cybersecurity with a management perspective within an organization, connecting technical security knowledge with the business responsibilities of establishing governance, managing risk, meeting compliance obligations, and overseeing a security program over time. The course covers security governance, security risk management, security controls and frameworks, compliance audit and assurance, security program management, and incident response and business continuity.
By the end of Cybersecurity Governance, Risk, and Compliance, students will be able to:
1. Develop cybersecurity plans and policies that align security with organizational goals and regulatory obligations, and explain the roles of boards, executives, and security leadership in carrying them out. (CPM)
2. Explain the legal, regulatory, and ethical obligations that shape cybersecurity decisions, apply ethical principles to real-world situations, and evaluate compliance using audit and assurance evidence. (PLE)
3. Assess and prioritize cybersecurity risks using established methodologies, and recommend controls and treatment strategies grounded in recognized standards and frameworks. (SRA)
4. Design, manage, and measure a cybersecurity program, including incident response and business continuity, and communicate its effectiveness to organizational leadership. (SPM)
Technical Skills
Industry GRC Applications and Skills: Students will learn skills like building a risk register, mapping controls to NIST CSF/CIS benchmarks, running a compliance gap analysis, writing security policies and IR plans, etc.
Artificial Intelligence in Cybersecurity GRC: Explore and apply AI technologies throughout the governance, risk, and compliance lifecycle. Students will use AI-assisted tools to support policy development and governance decisions, identify and assess cybersecurity risks, automate compliance analysis, and evaluate the opportunities, limitations, and ethical considerations of AI-driven GRC practices.
Transferable Skills
1. Critical thinking and decision-making: Analyze complex problems, weigh competing priorities, and make evidence-based recommendations under uncertainty.
2. Communication: Translate technical risks and requirements into clear, actionable information for executives, colleagues, and other stakeholders.
3. Leadership and collaboration: Coordinate across organizational functions, establish accountability, and build consensus around shared goals.
4. Strategic planning: Align initiatives with organizational objectives, allocate limited resources, and adapt plans as conditions change.
Experiential Learning
Experiential learning is embedded throughout the course through a fictional university that serves as a realistic organizational setting for applied assignments. Students take on cybersecurity governance, risk, and compliance challenges within an evolving institutional story, applying course concepts to scenarios involving competing priorities, limited resources, regulatory obligations, and security incidents. Assignments ask students to assess risks, recommend controls, develop policies, and plan responses while considering both technical and organizational needs. This approach provides a consequence-free environment in which students can exercise professional judgment, explore the implications of their decisions, and build confidence for similar challenges in the workplace