Course Outline
The curriculum covers training objectives, detailed module descriptions, allocated learning hours, and a recommended reading list to support your preparation.
Access the latest syllabus (PDF)
Overview of key topics:
1. Concepts and framework of information risk management
- The necessity of information risk management within the information lifecycle
- Understanding the context of risk within organizational structures
2. Fundamentals of information risk management
- Core principles of information security
- Confidentiality, integrity, and availability (CIA)
- Accountability, nonrepudiation, authenticity, privacy, secrecy, identification, resilience, and reliability
- Distinguishing between information security, cyber security, information risk management, and information assurance
- Standards and best practice guides for information risk management
- The information risk management process
- The four stages of information risk management: establishing context; risk assessment (including identification, analysis, evaluation, and treatment); communication and consultation; and monitoring and review
- Application of risk management methodologies
- Key information risk terms and definitions
- Defining concepts such as threats, hazards, vulnerabilities, proximity, likelihood, probability, and risk
- Strategic risk treatment options, including risk avoidance or termination; risk reduction or modification; risk transference or sharing; risk acceptance or tolerance; and risk retention
3. Establishing an information risk management program
- Requirements for an effective information risk management program
- The Plan-Do-Check-Act model, also known as the Deming Cycle
- Developing a strategic approach to information risk management
- Principles of information classification
4. Risk identification
- Processes for identifying information assets, both tangible and intangible
- Conducting a business impact analysis
- Performing threat and vulnerability assessments
5. Risk assessment
- Executing risk analysis
- Differences between and appropriate uses of qualitative, quantitative, and semiqualitative risk analysis
- Distinguishing between generic and specific risk analyses
- Constructing and utilizing a risk matrix
- Carrying out risk evaluation
6. Risk treatment
- Explaining risk treatment options, controls, and associated processes
- The four strategic risk treatment options: risk avoidance or termination; risk reduction or modification; risk transference or sharing; risk acceptance or toleration; and risk retention
- The purpose of tactical risk treatment controls: prevention; detection; correction; direction; elimination; impact minimisation, monitoring and awareness, deterrence, and recovery
- The three types of operational risk treatment controls: procedural/people; physical/environmental; and technical/logical
- Understanding the application of a risk treatment plan
7. Monitoring and review
- Explaining information risk monitoring practices
- Conducting an information risk review
8. Presenting risks and the business case
- Reporting and presenting the progress of a risk management program
- Presenting a robust business case
NobleProg is a BCS Accredited Training Provider.
This course is delivered by an expert NobleProg trainer who is approved by BCS.
The fee covers the delivery of the complete course syllabus by an approved BCS trainer, along with the BCS CIRM exam. The exam can be taken remotely at your convenience and is centrally invigilated by BCS. Upon successfully passing the exam, which is a multiple-choice format requiring a score of at least 65% to pass, participants will hold the accredited BCS Practitioner Certificate in Information Risk Management (CIRM).
Requirements
While there are no formal entry requirements, participants are expected to possess a foundational understanding of information assurance principles. This ensures they can engage effectively with the course material and apply concepts in a professional context.
It is also beneficial for candidates to be familiar with relevant legislation affecting information risk management, such as Data Protection or Freedom of Information regulations. This qualification is specifically tailored for Information Risk Managers and professionals responsible for information management across both public and private sectors, empowering them to lead secure and compliant information practices.
Testimonials (3)
Really enjoyed the topics covered and the way that the trainer ran the session
Richard
Course - BCS Practitioner Certificate in Data Protection
The trainer was helpful..
Attila - Lifial
Course - Compliance and the Management of Compliance Risk
1. The BCS test exam questions were often incoherent or not related to the syllabus - which appears to be a trait of BCS course and exams 2. the subject matter was taught reading powerpoint slides full of text - the BCS should be providing at least some diagrammatic content and other visual aids especially as many people learn in very different ways - more than just reading text.
