Everyday computing, information and assets
Start with a service people need, then identify the information, technology, people and providers that make it possible.
Risk concepts, scenarios, assessment and treatment
Describe a credible risk scenario before choosing a score, method or response.
Authentication, passwords and MFA
Learn what authentication evidence shows and why surrounding account controls still matter.
Identity lifecycle, least privilege and access-control models
Follow identities and permissions through joining, changing role and leaving, including non-human services.
Networks, layers, addresses, names and ports
Follow communication using layers, names, addresses and ports without confusing their functions.
Firewalls, zones, segmentation, Zero Trust and VPN boundaries
Use explicit policy and enforcement instead of assuming location, a product or a tunnel creates trust.
Cloud characteristics, service models and responsibilities
Understand cloud through characteristics, service boundaries and actual responsibilities.
Encryption, hashing, signatures and quantum-resistant cryptography
Choose a cryptographic purpose, then explain the trust and key assumptions.
Classifying, labelling, masking, retaining and sanitizing data
Connect handling rules to the life of information, including provider copies and disposal.
Logging, monitoring, SIEM, correlation and triage
Turn records into investigation while separating an alert from a confirmed incident.
Threat actors, threat intelligence and ATT&CK
Use threat context without turning motive labels or technique mappings into attribution.
Incident response, evidence and tabletop exercises
Prepare authority and communication, then use evidence to guide response and recovery.
Business continuity, disaster recovery and recovery objectives
Use business priorities to decide what must recover, how soon and with how much recoverable data.
Asset lifecycle, configuration, change and patch management
Treat configuration and patching as ongoing risk response with verification after change.
Security testing, team exercises and threat modelling
Choose a test for the assurance question and define authorization and limits first.
AI fundamentals and applications across the CC domains
Apply security foundations to AI inputs, models, identities, dependencies, outputs and decisions.
Measures, metrics, risk indicators and management reporting
Measure the question you need to answer and report enough context for a useful decision.
What an ISMS is, the standards family and PDCA
Move from controls to a recurring system of direction, resources, operation, evaluation and improvement.
Organizational context, scope, parties, leadership and policy
Define a meaningful system boundary, understand relevant parties and make leadership direction usable.
ISMS objectives, risk treatment, applicability and controls
Connect objectives, treatment and applicability so a control has a reason and evidence.
Support, competence, communication, documented information and operation
Support a working ISMS through competence, communication, controlled information and operation.
Performance evaluation, audit types and management review
Evaluate performance and audit evidence against criteria, then make review decisions.
Nonconformity, correction, causes, corrective action and improvement
Establish the failed requirement, fix the problem, investigate causes and check effectiveness.
Practice, feedback and a fictional learning portfolio
Use retrieval, scenarios and feedback, then connect fictional work into a coherent portfolio.
What this path still needs
- This is an editorial paper project, not a live deployment, organizational assessment or independent certification exercise.
- It does not authorize tests of real systems or use of private organizational records.