Specialist Certificate · Master's level · CPS-22

Cyber Risk, Business Continuity and Incident Response

For: Information systems security managers and technicians, business continuity managers, risk managers and crisis unit members.

Pre-register

Organisation over 20 weeks

Four 5-week blocks (4 weeks of classes, 1 week of assessment). The two course units are taken unchanged from the original degree: same content, same assessments.

Blocks 1 and 2 (weeks 1 to 10): GRC 423 — Risk Management and Business Continuity
Blocks 3 and 4 (weeks 11 to 20): INC 532 — Incident Response and Crisis Management

GRC 423 - Risk Management and Business Continuity

To make risk the basis of security decisions: the learner learns to assess risks, to propose their treatment to senior management and to prepare the organisation to keep operating despite a disaster.

Learning outcomes

Conduct a security risk assessment in line with the guidelines of the ISO 31000:2018 standard.
Propose a risk treatment plan and obtain senior management's acceptance of residual risks.
Conduct a business impact analysis and derive a continuity strategy from it.
Define business continuity and disaster recovery plans and organise their testing.

Content

ISO 31000:2018 standard: principles, framework and process of risk management; link with the risk assessment required by the ISO/IEC 27001:2022 standard.
Risk identification, analysis and evaluation: assets, threats, vulnerabilities, scenarios, likelihood and impact; risk register.
Risk treatment: reduction, transfer, avoidance, acceptance; treatment plan and follow-up.
Business impact analysis: critical processes, maximum tolerable downtime, maximum tolerable data loss.
Continuity and recovery plans: backups, fallback sites, dependencies (power, connectivity, service providers), exercises and upkeep.

Assessment: Project (60%): risk assessment and business continuity plan for a fictitious organisation. Final examination (40%): risk treatment case study.

INC 532 - Incident Response and Crisis Management

To prepare the learner to lead the response to an incident and to play their part in a crisis unit, where the survival of the business and the organisation's reputation are at stake. The course unit puts into practice the continuity plans designed in GRC 423.

Learning outcomes

Conduct the response to a security incident, from qualification to lessons learned.
Set up and run a crisis unit and evaluate how it functions.
Activate business continuity and disaster recovery plans in degraded conditions.
Report on the incident to senior management and the competent authorities, and steer improvement actions.

Content

Response cycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned.
Response playbooks by incident type: ransomware, email compromise, data leak, denial of service.
External coordination: CERT-SN, DCSSI and its CNOC, filing a complaint (channels and competent authorities studied on the basis of the Code de procédure pénale [Code of Criminal Procedure] as amended by loi n°2016-30), role of the Division spéciale de cybersécurité (Special Cybersecurity Division); any notification obligations, to be checked against loi n°2008-12 (Personal Data Protection Act) and against projet de loi n°25/2026 relatif à la protection des infrastructures d'information critiques et à la sécurité numérique (bill on the protection of critical information infrastructures and digital security), adopted by the Assemblée nationale (National Assembly), promulgation not verified.
Crisis unit: membership, roles, event log, decision-making chain, handover.
Crisis communication: internal, customers and users, partners, media, in several languages.
Tabletop crisis exercise and technical exercise in the laboratory.

Assessment: Simulated crisis exercise (50%), assessed against a rubric for each role. Incident report and improvement plan (50%).

Career opportunities

Security risk manager, business continuity manager, incident response analyst.

At your own pace: the self-paced pathway

In a class, this certificate takes 20 weeks, on the cohort's dates. On the self-paced pathway, you start whenever you like, online, and progress at your own pace. The price is the same.

Estimate how long my pathway will take

12 h / week · 240 hours in total

Duration: about 20 weeks
Estimated end: 20 weeks after you start
Examination: Online, subject to available slots, no earlier than 20 weeks after you start
Payment: In 1 to 5 monthly instalments, as you choose

An indicative estimate, for a start today and 240 hours of work. You can change your pace along the way; the pathway must be completed within 60 weeks (about 14 months) of your start. Your e-Campus access opens with your first payment.

Admission

Bachelor's degree in computer science or a related field, or experience in information systems security or operations assessed on application. Admission based on application; detailed requirements set by the school.

The credits you earn are recognised without further assessment if you later join the programme they come from, Professional Master's degree in Cybersecurity, within a period set by the certificate regulations.