Risk Management for Organisations

This course develops both theoretical knowledge and practical competence in cybersecurity risk management for organisations. Students will build a solid grounding in risk management principles and strategies, gain familiarity with key industry standards and frameworks, and develop hands-on experience with tools used for threat modelling and risk assessment. Throughout the course, theory and practice are closely integrated, with practical tasks designed to reinforce and contextualise the concepts introduced. The course is structured into three parts: Part 1 — Foundations: An introduction to cybersecurity risk management theory, including risk identification strategies, the risk management lifecycle, and an overview of relevant standards and frameworks such as ISO 27001 and the NIST Cybersecurity Framework. Part 2 — Tools and Methods: A practical introduction to industry-recognised tools and techniques for threat modelling and risk assessment, including guided exercises to build confidence in their application. Part 3 — Applied Exercise: Students apply their knowledge by conducting a risk management exercise, with the option to work with a provided mockup organisation or draw on material from their own professional setting. This flexibility allows the exercise to be directly relevant to each student's organisational context. The course concludes with peer evaluation and structured discussion of the risk management exercise, developing students' ability to communicate, present, and defend risk findings to an informed audience.