Cyber and IT Security Governance, Risk, and Compliance
About This Course
Identifying a risk is not the same as managing it. Managing risk requires knowing which internal controls are failing, how those failures connect to business operations and the product development lifecycle, and how to translate that understanding into a structured security programme that holds up against regulatory scrutiny and leadership oversight.
This course develops the enterprise security governance capability that sits between risk awareness and operational control implementation. Trainees learn to assess security risks through the product development lifecycle, evaluate the effectiveness and efficiency of internal controls, measure the business impact of control gaps, map organisational processes to security system requirements, translate security objectives and control gap findings into structured initiatives and programmes, align security strategy with the organisation's IT strategy, established frameworks, and regulatory obligations including PDPA, MAS TRM, and ISO 27001, and monitor the effectiveness of security initiatives against internal standards and external benchmarks.
The course works through vendor and third-party risk evaluation, regulatory compliance mapping, risk maturity assessment, and security programme budgeting, the applied capabilities that convert theoretical risk management understanding into an enterprise security function that can be measured, reported, and continuously improved.
By the end of the course, trainees will be able to assess organisational security posture and product lifecycle risks with rigour, design structured security programmes aligned to risk findings, IT strategy, and regulatory obligations, and monitor initiative effectiveness in a way that gives leadership and governance bodies a credible, evidence-based view of security performance.
What You'll Learn
- Assess gaps in existing internal controls and evaluate their effectiveness, efficiency, and business impact
- Assess security risks through the product development lifecycle, from requirements and design through build, deployment, and operations
- Map organisational business processes to security requirements and identify where protection must be strengthened
- Benchmark security posture against IT standards and frameworks including ISO 27001, NIST CSF, and MAS TRM
- Translate control gap findings and security objectives into structured security programmes and action plans
- Align security programmes with the organisation's IT strategy, business direction, and long-term technology plans
- Evaluate the security posture of vendors, partners, and third-party providers
- Map security programmes to PDPA, MAS TRM, and applicable regulatory obligations under a governance, risk, and compliance approach
- Apply internal and external security standards consistently across the organisation
- Align security initiatives with information security and assurance architectures and advise stakeholders on adoption
- Govern and monitor the effectiveness of security initiatives against internal standards and regulatory benchmarks
Entry Requirements
● Minimum age: 21
● 2 years in an IT, cybersecurity, risk, compliance, audit, governance, or technology-adjacent role
● Foundational cybersecurity knowledge equivalent to a prior introductory cybersecurity course or on-the-job exposure (CIA triad, common threat categories, basic risk concepts)
● Working familiarity with at least one regulatory framework relevant to the learner's organisation (e.g., PDPA, MAS TRM, or sector-equivalent)
● Computer literate, with the ability to work confidently with productivity software (documents, spreadsheets) and structured analytical templates
● Proficient in written and spoken English at a professional working level, sufficient to interpret regulatory text and contribute to scenario-based discussion
● Diploma or equivalent professional qualification
● Targeted at PMEs with current or intended responsibility for organisational security strategy, governance, risk, or compliance