Critically examine the impact of risks and external threats on your industry. Differentiate between the components of the governance, risk and compliance (GRC) model. Calculate common vulnerability scores when presented with data on different types of security vulnerabilities. Discuss how your organization can buffer its technological infrastructure by addressing gaps with the Common Vulnerability Scoring System (CVSS). Apply the GRC model to complete a practical learning scenario. Evaluate the consequences and components of the GRC model within your organization.

Determine the impact of security policies within your organization. Differentiate between the characteristics of good and poor security policies. Match the descriptions of security policies to their appropriate titles. Discuss the critical role that security policies can have within your specific industry and how to socialize policies in your organization. Develop an example of a security policy or policy exception from a list of provided policy areas.

List strategies and tools that cultivate a culture of security within your organization. Describe the significance of security awareness and training at your company. Explain how to empower and motivate non-security staff to enforce and implement security protocols and policies. Discuss best practices and procedures for reducing security silo syndrome and increasing security awareness and training. Develop an action plan or training strategies at your company that revolve around a culture of security.

Explain the investment that an enterprise architecture can provide to company leadership and organizations. Compare and contrast the function of security architecture functions, enterprise architecture and reference architecture. Describe the purpose, characteristics and requirements for an enterprise architecture. Discuss how security requirements and security architecture functions inform organizational goals and growth. Identify how to improve, update and prioritize security architecture functions within your organization.

Determine how your company can vet and select appropriate security tools, technologies and products. Examine what comprises a minimum viable security tool collection to enable efficiency among your security team. Locate and research different security vendors that your organization can utilize. Discuss the types of services and differentiating characteristics of security technologies, vendors and products. Describe the strengths, weaknesses, opportunities and threats of different security technologies to determine what is beneficial or disadvantageous for your organization.

List steps your company can take to implement and strengthen its incident response plan (IRP). Describe the roles and responsibilities that comprise an incident response team. Determine the signs of a security incident that assist with categorizing and rating their severity levels. Discuss the strengths and weaknesses of an incident response plan to prepare your company for the unknown. Describe how an incident response plan can be socialized and leveraged within your organization.

Explain what to prioritize when vetting security vendors to better inform your security team. Differentiate and identify the proper resources for the various security team roles. Analyze company breach reports to educate yourself and others on cybersecurity trends and various attack types. Discuss and share additional resources applicable to your organization or industry on security practices and education. Critique the content of security resources and explain how they can be implemented within your professional and work life.

Identify strategies your company can employ to ensure leadership can respond to cyber attacks. Organize your security team and the security team functions so they integrate into the communicative structure of your organization. Explain the strengths of and methods to develop incident response plans. Discuss incident response plans as they relate to people, processes, technologies and proactive actions that mitigate risks. Evaluate how security team functions relate to developing an incident response plan.