Security Risk & Audit Certification

Module 1: Introduction to Security Risk & Audit

• Information security fundamentals
• Risk and audit concepts
• Security objectives
• Enterprise security risks
• Audit lifecycle
• Roles and responsibilities

Module 2: Cybersecurity Risk Management

• Risk management principles
• Risk identification
• Risk analysis
• Risk evaluation
• Risk treatment
• Continuous monitoring

Module 3: Security Governance

• Governance fundamentals
• Organizational structure
• Security policies
• Roles and responsibilities
• Management oversight
• Security strategy

Module 4: Risk Assessment Methodology

• Asset identification
• Threat identification
• Vulnerability analysis
• Likelihood assessment
• Impact assessment
• Risk determination

Module 5: Risk Registers & Documentation

• Risk register development
• Risk statements
• Risk ownership
• Risk ratings
• Treatment plans
• Risk tracking

Module 6: Security Control Frameworks

• Control framework concepts
• Administrative controls
• Technical controls
• Physical controls
• Preventive controls
• Detective and corrective controls

Module 7: Security Audit Planning

• Audit objectives
• Audit scope
• Risk-based planning
• Audit resources
• Audit schedules
• Audit documentation

Module 8: Audit Evidence & Testing

• Evidence collection
• Sampling
• Interviews
• Documentation reviews
• Control testing
• Evidence evaluation

Module 9: Access Control Auditing

• Identity management
• User provisioning
• Privileged access
• Access reviews
• Segregation of duties
• Authentication controls

Module 10: Network & Infrastructure Auditing

• Network architecture
• Firewall controls
• Network segmentation
• Secure configurations
• Infrastructure monitoring
• Configuration reviews

Module 11: Application Security Auditing

• Application controls
• Secure development practices
• Authentication controls
• Authorization controls
• Change management
• Application monitoring

Module 12: Data Security Auditing

• Data classification
• Encryption
• Data access
• Data retention
• Backup controls
• Secure disposal

Module 13: Cloud Security Auditing

• Cloud governance
• Shared responsibility
• Cloud identity
• Cloud configurations
• Logging and monitoring
• Cloud risk assessment

Module 14: Vulnerability & Patch Management Auditing

• Vulnerability management
• Security scanning
• Patch processes
• Risk prioritization
• Remediation tracking
• Control effectiveness

Module 15: Third-Party Security Risk

• Vendor identification
• Supplier assessments
• Security requirements
• Risk classification
• Ongoing monitoring
• Third-party governance

Module 16: Incident Management Auditing

• Incident response processes
• Detection and escalation
• Investigation procedures
• Response documentation
• Recovery activities
• Lessons learned

Module 17: Business Continuity & Resilience

• Business impact analysis
• Continuity planning
• Disaster recovery
• Backup strategies
• Recovery testing
• Operational resilience

Module 18: Security Metrics & Monitoring

• Key risk indicators
• Key performance indicators
• Security dashboards
• Control monitoring
• Risk reporting
• Management reporting

Module 19: Audit Findings & Root Cause Analysis

• Finding identification
• Risk classification
• Root cause analysis
• Control weaknesses
• Corrective actions
• Remediation tracking

Module 20: Security Audit Reporting

• Audit report structure
• Executive summaries
• Technical findings
• Risk communication
• Recommendations
• Stakeholder presentation

Module 21: Risk Treatment & Remediation

• Risk avoidance
• Risk mitigation
• Risk transfer
• Risk acceptance
• Remediation planning
• Residual risk

Module 22: Continuous Risk & Audit Improvement

• Continuous monitoring
• Control reassessment
• Risk reviews
• Audit follow-up
• Security maturity
• Improvement roadmap