Cybersecurity Governance and Compliance

Organisation over 20 weeks

Four 5-week blocks (4 weeks of classes, 1 week of assessment). The two course units are taken unchanged from the original degree: same content, same assessments.

• Blocks 1 and 2 (weeks 1 to 10): GRC 411 — Information Security Governance and Management
• Blocks 3 and 4 (weeks 11 to 20): DRS 412 — Cybersecurity and Data Protection Law

GRC 411 - Information Security Governance and Management

To establish the core of the security manager's profession: organising information security governance and steering it as a management system. The learner learns to move from a collection of technical measures to a policy decided by senior management, cascaded down and measured.

Learning outcomes

• Carry out a review of an organisation's information security and report the gaps identified.
• Define an information systems security policy (ISSP) and translate it into procedures, charters and good practice.
• Select and justify the applicable security controls in a statement of applicability.
• Build the indicators and dashboard used to report the level of maturity to senior management.

Content

• Security governance: roles of senior management, the CISO, business units and service providers; security committee; responsibility matrix.
• Information security management system under ISO/IEC 27001:2022: context, leadership, planning, support, operation, performance evaluation, improvement; certification and third-party audit.
• Security controls of ISO/IEC 27002:2022, grouped into organisational, people, physical and technological themes; statement of applicability.
• ISSP: structure, cascading into procedures and acceptable use charters, review cycle.
• Security resources: staff, skills, tools, budget in FCFA (CFA francs), outsourcing.
• Maturity indicators, dashboard and annual report to senior management.

Assessment: Continuous assessment (40%): review and statement of applicability for a fictitious organisation. Final examination (60%): case study, drafting a reasoned ISSP and its dashboard. Same marking scheme and rubrics on campus and online.

DRS 412 - Cybersecurity and Data Protection Law

To give cybersecurity managers command of the law that governs their work: what the law punishes, what it requires of organisations, and whom to turn to. Without this foundation, no security decision and no investigation can be made legally secure.

Learning outcomes

• Legally classify an incident in the light of the offences provided for by loi n°2008-11 (Cybercrime Act) and by the Code pénal (Criminal Code) as amended by loi n°2016-29.
• Identify an organisation's obligations regarding personal data protection, electronic communications and electronic transactions.
• Identify the competent authorities and bodies and the procedure applicable to each situation.
• Analyse a text taking its status into account: in force, adopted but not promulgated, or draft.

Content

• Cybercrime: loi n°2008-11 du 25 janvier 2008 portant sur la cybercriminalité; loi n°2016-29 du 8 novembre 2016 modifiant la loi n°65-60 du 21 juillet 1965 portant Code pénal (Act amending the Criminal Code), which brings together the offences relating to information and communication technologies.
• Procedure: loi n°2016-30 du 8 novembre 2016 modifiant le Code de procédure pénale (Act amending the Code of Criminal Procedure), any provisions of which specific to investigations involving computer data are identified and studied from the text; role of the Division spéciale de cybersécurité (Special Cybersecurity Division) of the Police nationale (National Police).
• Regional and international framework: ECOWAS directive C/DIR/1/08/11 portant lutte contre la cybercriminalité (Directive on Fighting Cybercrime); Budapest Convention; Malabo Convention; international cooperation.
• Data protection: loi n°2008-12 du 25 janvier 2008 (Personal Data Protection Act) and role of the CDP; ECOWAS Acte additionnel A/SA.1/01/10 (Supplementary Act on Personal Data Protection); a reform has been announced, but no replacement law adopted had been found at the time of writing.
• Electronic communications and transactions: Code des communications électroniques (Electronic Communications Code) (loi n°2018-28) and role of the ARTP; loi n°2008-08 du 25 janvier 2008 sur les transactions électroniques (Electronic Transactions Act) and décret n°2008-720 du 30 juin 2008 relatif à la certification électronique (Decree on Electronic Certification).
• Current developments: projet de loi n°25/2026 relatif à la protection des infrastructures d'information critiques et à la sécurité numérique (Bill on the Protection of Critical Information Infrastructure and Digital Security), adopted by the Assemblée nationale (National Assembly), promulgation not verified; method for monitoring official sources.

Assessment: Continuous assessment (40%): text analysis sheets and annotated monitoring report. Written final examination (60%): practical case on the legal classification of an incident, identifying the organisation's obligations and the authorities to be referred to.

Career opportunities

Information security focal point, compliance officer, support to the chief information security officer (CISO).

At your own pace: the self-paced pathway

In a class, this certificate takes 20 weeks, on the cohort's dates. On the self-paced pathway, you start whenever you like, online, and progress at your own pace. The price is the same.

Admission

Bachelor's degree in a related field (computing, information systems, law, management) or equivalent professional experience assessed on application; command of the everyday use of an information system. Admission based on application; detailed requirements set by the school.

The credits you earn are recognised without further assessment if you later join the programme they come from, Professional Master's degree in Cybersecurity, within a period set by the certificate regulations.