COMP 6660 · Assignment 3 Governance and Cyber Resilience

COMP 6660 · Assessment · Assignment 3

COMP 6660 · Enterprise Cybersecurity Enterprise Security Governance and Cyber Resilience

Assignment 3 is the integrative assignment for the course. It assesses your understanding of the governance, risk, compliance, resilience, and emerging-trend material examined in Unit 6 — and your ability to integrate it with the foundations, threats, architecture, and infrastructure material from the earlier modules. It requires a scholarly research paper on cybersecurity governance and risk management, and a set of technical questions requiring applied design across governance, risk assessment, incident response, resilience, and artificial intelligence.

Read the brief Course home
Weight: 20% of final grade Coverage: Unit 6 · Integrated course concepts Estimated effort: 30–35 hours

01 Overview

Assignment 3 is the final and integrative written assignment for COMP 660. It assesses your understanding of the governance, risk, compliance, resilience, and emerging-trend material examined in Unit 6 — and your ability to integrate it with the foundations, threats, architecture, and infrastructure material from the earlier modules.

The assignment has two parts. Part A is a scholarly research paper on Cybersecurity Governance and Risk Management in Large Enterprises: Integrating NIST CSF, ISO/IEC 27001, and Zero Trust Principles — requiring you to synthesise academic and industry literature across three major frameworks, to analyse how they relate, and to evaluate how they can be integrated into a coherent enterprise programme. Part B is a set of five technical questions requiring applied design — covering a governance framework for a university, a risk assessment for critical infrastructure, an enterprise ransomware incident-response plan, a business continuity and disaster recovery strategy, and an evaluation of artificial intelligence in enterprise cybersecurity.

Purpose

  • To consolidate your understanding of the governance, risk, compliance, resilience, and emerging-trend material examined in Unit 6.
  • To develop your capability to design governance frameworks, to conduct risk assessments, to develop incident response plans, to design resilience strategies, and to evaluate the strategic implications of emerging technology.
  • To integrate the material examined across the whole course — foundations, technologies, threats, architecture, infrastructure, and governance — into a coherent professional capability.
  • To prepare for the final examination, whose Part C case study requires integrated analysis of an enterprise cybersecurity problem.

Coverage

  • Unit 6 — Enterprise Cybersecurity Governance, Risk, and Compliance (Lessons 6.1–6.10).
  • Integrated course concepts — the foundations, technologies, threats, architecture, and infrastructure material examined in Units 1–5, as applied within the governance and resilience context.

Task summary

  • Part A — Research paper (approx. 2,000–2,500 words).
  • Part B — Five technical questions (approx. 1,500–2,000 words total).

Weight and value

  • Weight: 20% of the final course grade.
  • Contribution to CLOs: CLO1, CLO4, CLO6, CLO7, CLO8, CLO9.
  • Estimated effort: 30–35 hours of focused work.

How to approach this assignment

Begin by reviewing Unit 6 in full, and by revisiting the material in Units 1–5 that the technical questions draw on. Part A requires you to engage with three major frameworks — NIST CSF 2.0, ISO/IEC 27001, and Zero Trust — and to reason about how they relate, where they complement each other, and where they overlap or conflict. Part B requires applied design across a range of enterprise contexts — a university, critical infrastructure, an enterprise facing ransomware, and an enterprise deploying AI. The technical questions in this assignment are the most integrative in the course; they assume the knowledge developed in Units 1–5 and require you to apply that knowledge within the governance and resilience context.

02 Learning outcomes assessed

Assignment 3 assesses the following Course Learning Outcomes (CLOs):

Course learning outcomes assessed by Assignment 3
CLO Description Where assessed
CLO1 Define the scope, objectives, principles, and strategic importance of enterprise cybersecurity. Part A and Part B — the strategic framing of the governance and resilience material.
CLO4 Design and assess enterprise cybersecurity architectures and controls. Part B — university governance framework, business continuity and disaster recovery strategy.
CLO6 Develop cybersecurity governance, risk-management, compliance, and policy frameworks. Part A in full, and Part B — governance framework for a university, risk assessment for critical infrastructure.
CLO7 Evaluate incident response, business continuity, disaster recovery, and cyber-resilience strategies. Part B — enterprise ransomware incident-response plan, business continuity and disaster recovery strategy.
CLO8 Assess emerging cybersecurity technologies, trends, and challenges. Part A (framework integration) and Part B (AI in enterprise cybersecurity).
CLO9 Conduct scholarly research and communicate cybersecurity findings effectively. Part A in full — research, synthesis, and academic communication.

Unit-level learning outcomes for Unit 6 are mapped in the unit learning outcomes page: Unit 6 outcomes.

03 Submission details

Submission information
Item Detail
Format Single PDF document, submitted through Brightspace.
File name COMP660_Assignment3_LastName_FirstName.pdf
Length Part A: 2,000–2,500 words (excluding references and appendices).
Part B: 1,500–2,000 words total.
Total: 3,500–4,500 words.
Formatting 12-point serif or sans-serif font; 1.15 or 1.5 line spacing; 2.5 cm (1 inch) margins; page numbers; consistent heading structure; title page with name, student ID, course code, assignment title, and submission date.
Referencing style APA 7th edition, or an equivalent recognised scholarly style (IEEE, Harvard) applied consistently.
Minimum sources Part A: at least 12 scholarly or authoritative sources, of which at least 6 should be peer-reviewed or from standards bodies (NIST, ISO/IEC, ENISA, CISA), reflecting the three frameworks examined.
Due date See the course schedule in Brightspace for the exact due date.
Late penalty 5% of the assignment mark per calendar day late, to a maximum of five days, after which the assignment is not accepted unless an extension has been approved.
Extensions Requests must be submitted to the course instructor before the due date, with a reasonable explanation and, where relevant, supporting documentation.

Before you submit

Submit your assignment as a single PDF. Check the PDF for formatting problems — particularly for tables, governance structures, and resilience diagrams, which are central to Part B. Ensure that every in-text citation is matched by a full reference, and that every reference is cited in the text. Check the word count for each part, and confirm that your submission complies with the academic integrity and AI-use expectations set out below.

04 Part A — Research paper

Research topic

Cybersecurity Governance and Risk Management in Large Enterprises: Integrating NIST CSF, ISO/IEC 27001, and Zero Trust Principles

What is required

Write a scholarly research paper of 2,000–2,500 words on the research topic above. The paper must:

  • Examine each of the three frameworks — NIST Cybersecurity Framework 2.0, ISO/IEC 27001, and Zero Trust principles — including their origins, their purpose, their structure, and their intended use. Distinguish clearly between what each framework is designed to achieve.
  • Analyse how the frameworks relate — where they complement each other, where they overlap, where they express the same concepts in different terms, and where they may conflict or produce tension. Be precise about the levels at which each framework operates — programme organisation, management system, technical architecture — and how the levels interact.
  • Evaluate the integration challenge — why integrating the three frameworks is difficult in practice, what enterprises typically get wrong when they attempt to integrate them, and what the integration requires of governance, of risk management, of architecture, and of the security function.
  • Examine the governance and risk dimensions — how the three frameworks address board oversight, executive accountability, risk appetite, risk assessment, and the risk-management process. How do they relate to the enterprise's broader enterprise risk management framework?
  • Develop an integration approach — practical guidance on how a large enterprise should integrate the three frameworks into a coherent security programme. Be specific about the sequence, the mapping, the control framework, and the governance arrangements.
  • Synthesise scholarly and industry sources — drawing on peer-reviewed research, on the frameworks themselves, on standards bodies (NIST, ISO/IEC), and on authoritative industry publications.
  • Present an original argument — the paper is not a summary of the three frameworks; it advances a considered position on how they should be integrated, supported by evidence and by critical analysis.

Suggested structure

  • Introduction

    Introduce the topic, establish its significance for large enterprises, define the scope of the paper, and state the paper's thesis. Explain what the paper will argue and how it will be structured. Note that the three frameworks operate at different levels, and that the paper's contribution is to reason about their integration.

  • The three frameworks

    Examine each framework in turn — NIST CSF 2.0 (Govern, Identify, Protect, Detect, Respond, Recover); ISO/IEC 27001 (the ISMS management system, the Annex A controls, and the certification model); Zero Trust (the principles, the architecture, and NIST SP 800-207). Be precise about what each is for.

  • How the frameworks relate

    Analyse the relationships between the frameworks. NIST CSF provides the organising structure and the common vocabulary; ISO/IEC 27001 provides the management system and the certifiable control framework; Zero Trust provides the architectural principles for the modern estate. Examine where they overlap, where they complement, and where they may conflict.

  • The integration challenge

    Examine why integration is difficult. Common failures include parallel frameworks, duplicate assessment, mapping without maintenance, certification treated as the objective, and Zero Trust treated as a project rather than as an architectural principle. Analyse these failures and their consequences.

  • Governance and risk dimensions

    Examine how the three frameworks address governance and risk — board oversight, executive accountability, risk appetite, risk assessment, and the risk management process. Discuss how they relate to enterprise risk management and to the governance arrangements examined in Lesson 6.1.

  • An integration approach

    Develop practical guidance on how a large enterprise should integrate the three frameworks. Be specific about the sequence (which framework to adopt first), the common control framework, the mapping between frameworks, the evidence base, and the governance arrangements. Discuss what should change in the enterprise's security programme.

  • Critical evaluation and conclusion

    Critically evaluate the integration approach — what it achieves, what it does not, and what remains contested. Conclude with the paper's argument and its implications for enterprise practice.

    • Marking criteria for Part A

    Part A marking criteria
    Criterion Weight What the marker looks for
    Understanding of the frameworks 25% Accurate, comprehensive, and nuanced understanding of NIST CSF 2.0, ISO/IEC 27001, and Zero Trust principles. Precise distinction between the levels at which each framework operates.
    Analysis and critical evaluation 25% Sophisticated analysis of how the frameworks relate, of the integration challenge, and of the governance and risk dimensions. Critical evaluation of the integration approach and of its limitations.
    Use of scholarly sources 20% At least 12 scholarly or authoritative sources, correctly integrated and cited, reflecting the three frameworks. Synthesis rather than summary.
    Argument and structure 15% Clear thesis, coherent structure, logical progression, and a conclusion that follows from the analysis. Original argument, not merely a survey of the three frameworks.
    Academic communication 10% Clear, precise, and professional academic prose. Correct grammar, spelling, and punctuation. Correct referencing and consistent formatting.
    Engagement with course material 5% Explicit engagement with Unit 6 material — particularly the governance, risk management, compliance, audit, and resilience material examined in the lessons.

    Research tips

    Begin with the primary sources — the NIST CSF 2.0 document itself, ISO/IEC 27001:2022, NIST SP 800-207 (Zero Trust Architecture), and NIST SP 800-53 (the control catalogue underlying much of the NIST material). Then move to secondary literature — peer-reviewed papers on framework integration, on Zero Trust adoption, and on ISMS implementation. Look for papers that critique the frameworks, or that examine integration failures, or that provide empirical evidence about what works. The integration question — how the three frameworks relate — is comparatively under-researched, so your reasoned analysis of it is genuinely valuable.

    05 Part B — Technical questions

    Answer all five technical questions below. Each answer should be approximately 300–400 words, combining conceptual explanation with applied design. Where a question requires a design or a framework, structure your answer accordingly — with clearly identified components, justifications, and reasoned conclusions. Diagrams are welcome and, where appropriate, encouraged.

    Question 1 — Develop a cybersecurity governance framework for a university

    A mid-sized university has 22,000 students, 3,000 academic and professional staff, and a research portfolio spanning multiple disciplines. It operates a mix of central IT services, faculty-based systems, research computing environments, and a growing cloud estate. The university is subject to privacy regulation, to research data protection obligations, to funding body requirements, and to the expectations of its students, staff, research partners, and the public.

    Develop a cybersecurity governance framework for the university. Your answer should:

    • Describe the governance structures — the board and its committees, the executive forum, the security steering committee, and their decision rights. Address the specific challenge that universities present — with decentralised governance, with academic freedom, and with a large population of transient members (students, visiting researchers, contractors).
    • Define the roles and accountabilities — applying the three lines model to the university context. Identify who owns which risks, who sets policy, who challenges, and who assures. Address the specific challenge that the university's core academic mission sits outside the traditional IT function.
    • Define the CISO role — reporting line, mandate, authority, budget, and board access. Justify your design choices with reference to the university's specific context.
    • Draft an outline risk appetite statement for the university — with at least three measurable tolerances across the dimensions that matter most (student data, research data, teaching continuity, financial systems).
    • Define the policy hierarchy — the documents the university should establish, what each contains, and who approves each level. Address the specific challenge of the university's decentralised operations.
    • Define the reporting and metrics — the board dashboard, the leading and lagging indicators, and the reporting cadence.
    • Address the specific university challenges — academic freedom and shared governance, the federated research environment, the large and mobile user population, the academic calendar dependencies, and the multi-jurisdictional privacy landscape for international students and research partners.

    Support your design with reference to ISO/IEC 27001, to NIST CSF 2.0, to the three lines model, and to Lessons 6.1 and 6.2.

    Question 2 — Perform a cybersecurity risk assessment for critical infrastructure

    A regional electricity distribution operator serves 500,000 customers across a mixed urban and rural area. It operates substations, a SCADA system, protection and control devices (IEDs), and a corporate IT estate. It has recently completed a substation automation programme that introduced IP-connected IEDs and remote management capability. The operator is subject to sector regulation and to national critical infrastructure obligations.

    Perform a cybersecurity risk assessment for the operator. Your answer should:

    • Define the risk assessment approach — the framework, the method (qualitative, semi-quantitative, or quantitative), and the reason for the choice given the operator's context and obligations.
    • Define the scope of the assessment — the systems in scope, the dependencies, the trust boundaries, and any explicit exclusions with justification.
    • Identify at least eight specific risks — expressed in the cause-event-consequence format — covering the operational technology, the IT estate, the third-party dependencies, the human and organisational dimensions, and the specific risks that the substation automation programme has introduced.
    • Assess each risk — likelihood and impact — with reference to the specific characteristics of the operational technology environment (safety, availability, determinism, long lifecycle, physical accessibility) examined in Lesson 5.8.
    • Determine the residual risk for each — considering the existing controls and their effectiveness — and identify which risks exceed the assumed appetite.
    • Recommend treatments for the highest-priority risks — including the trade-offs between security and operational continuity, and the specific controls (segmentation, zones and conduits, remote access control, monitoring) that are appropriate for OT.
    • Recommend the reporting — what should be reported to the board, to the sector regulator, and to national authorities, and with what cadence.

    Support your assessment with reference to IEC 62443, to NIST SP 800-82, to the NIST RMF, and to Lessons 6.3 and 5.8.

    Question 3 — Develop an enterprise ransomware incident-response plan

    A mid-sized enterprise — a national logistics company — has experienced a ransomware incident. The adversary gained initial access through a compromised credential, moved laterally through the enterprise's flat network, exfiltrated customer and operational data, and deployed ransomware that has encrypted the enterprise's transport management system, its warehouse management system, and its file servers. The adversary has issued a ransom demand and threatened to publish the exfiltrated data.

    Develop an enterprise ransomware incident-response plan for the company. Your answer should:

    • Define the classification and severity of this incident — against a defined scheme — and the escalation triggers that apply.
    • Define the incident response team for this incident — the roles, the authority, the escalation path to executive leadership, and the external specialists that should be engaged (incident response, legal, forensics, negotiation, communications).
    • Describe the detection and analysis approach — how the enterprise determines the scope of the compromise, the adversary's access, and the exfiltration that has occurred.
    • Describe the containment approach — the specific containment actions, the trade-offs between speed and evidence preservation, and how containment coordinates with the business (which depends on the affected systems).
    • Describe the eradication and recovery approach — including how the enterprise should restore from backup (assuming immutable backups exist), how restoration is verified, and how the enterprise prevents recurrence during the restoration.
    • Address the ransom payment decision — the process, the parties involved, the legal and regulatory considerations, and the enterprise's decision-making framework. The plan should not assume a specific decision, but must establish how the decision is made.
    • Address the data disclosure threat — how the enterprise responds to the adversary's threat to publish the exfiltrated data, including customer communication, regulatory notification, and reputation management.
    • Define the notification and communication approach — including regulatory notification (with the specific regimes that apply and the timeframes), customer communication, employee communication, and law enforcement engagement.
    • Define the post-incident activity — the review, the root cause analysis, and the improvements that should follow.

    Support your plan with reference to NIST SP 800-61, to CISA #StopRansomware guidance, to GDPR and equivalent notification regimes, and to Lessons 6.7 and 6.9.

    Question 4 — Design a business continuity and disaster recovery strategy

    A regional health authority operates five hospitals, 40 clinics, a shared electronic health record (EHR) system, a picture archiving and communication system (PACS), a clinical laboratory system, and a corporate IT estate. It is subject to health privacy regulation and to sector continuity obligations. The authority has experienced several recent disruptions — a PACS outage, a failed software update that interrupted admissions, and a supplier failure that affected its patient transport scheduling system.

    Design a business continuity and disaster recovery strategy for the authority. Your answer should:

    • Describe the business impact analysis approach — how the authority should identify its critical functions, assess the impact of disruption over time, and identify dependencies. Identify the functions you would classify as most critical and why.
    • Define recovery objectives — RTO, RPO, MTD, and MBCO — for at least three critical systems (the EHR, the PACS, and one clinical system of your choice), with justification derived from the impact analysis.
    • Describe the business continuity strategy — how the authority maintains clinical operations during disruption, including manual workarounds, alternate arrangements, and the specific considerations that clinical environments present (patient safety, clinical judgement, regulatory obligations).
    • Describe the disaster recovery strategy — the recovery strategies selected for the critical systems, the backup approach, the recovery infrastructure, and the verification.
    • Describe the backup and restoration capability — including the 3-2-1-1-0 principle, the immutable or air-gapped backup arrangements, the restoration testing, and the specific considerations for clinical data.
    • Describe the testing and exercise programme — the types of exercises, the frequency, the participants, and the specific considerations for clinical environments (patient safety, clinical availability, regulator involvement).
    • Describe the governance and coordination — the ownership, the reporting to the board, the integration with incident response and with enterprise risk management, and the coordination with external parties (clinical networks, suppliers, regulators).
    • Address the specific health sector challenges — patient safety, clinical judgement, regulatory obligations, the 24/7 operating environment, the mixed estate of clinical and corporate systems, and the reliance on third-party clinical systems.

    Support your design with reference to ISO/IEC 22301, to NIST SP 800-34, to health sector continuity guidance, and to Lesson 6.8.

    Question 5 — Evaluate the opportunities and risks of artificial intelligence in enterprise cybersecurity

    An enterprise is considering the deployment of artificial intelligence across its security operations and its enterprise systems. It wishes to realise the opportunities that AI offers — improved detection, faster response, more efficient operations — while managing the risks that AI introduces — the security of AI systems, the use of AI by adversaries, the governance of AI decisions, and the regulatory obligations that apply.

    Evaluate the opportunities and risks of AI in enterprise cybersecurity for this enterprise, and recommend an approach. Your answer should:

    • Evaluate the opportunities for AI in the enterprise's security operations — anomaly detection, alert triage, automated response, threat hunting, vulnerability prioritisation, and code analysis. Assess which opportunities are most valuable for the enterprise and why.
    • Evaluate the opportunities for AI in the enterprise's broader security capability — including risk quantification, compliance monitoring, and control assessment.
    • Evaluate the risks that AI introduces — the security of AI systems (model poisoning, prompt injection, adversarial inputs, model theft, data leakage), the governance risks (accountability, transparency, oversight), the operational risks (false positives, model drift, dependency), and the regulatory risks (the EU AI Act and equivalent regimes).
    • Evaluate the threat that AI-enabled attack presents — the reduction of cost, the increase in scale, and the shift in the balance between attack and defence. Assess how the enterprise should adapt its defence accordingly.
    • Evaluate the governance requirements — the policies, processes, and structures through which the enterprise should govern its use of AI. Address accountability, transparency, data governance, risk assessment, oversight, and regulatory compliance.
    • Recommend an approach — what the enterprise should do, in what sequence, and with what governance. Be specific about the first steps, about the AI use cases that should be prioritised, and about the controls that should be established before deployment.
    • Identify the metrics — how the enterprise will know whether its AI adoption is succeeding and whether its AI risks are being managed.

    Support your evaluation with reference to the EU AI Act, to NIST's AI Risk Management Framework, to ISO/IEC 42001, and to Lesson 6.10.

    Marking criteria for Part B

    Part B marking criteria
    Criterion Weight What the marker looks for
    Technical accuracy 30% Correct, precise, and current understanding of the concepts addressed in each question — governance, risk management, incident response, continuity, resilience, and AI. Use of appropriate terminology.
    Applied design 30% Ability to design governance frameworks, risk assessments, incident response plans, and resilience strategies for the specific enterprise contexts. Quality and coherence of design decisions, with clear justification.
    Critical evaluation 20% Recognition of trade-offs, limitations, and alternatives — including the specific organisational, cultural, and regulatory challenges that each context presents. Willingness to identify where a framework or approach is not appropriate.
    Use of published guidance 10% Reference to relevant standards, frameworks, and authoritative sources (NIST, ISO/IEC, CISA, ENISA, sector regulators). Appropriate use of citations.
    Academic communication 10% Clear, structured, and professional answers. Correct grammar and referencing. Diagrams where appropriate.

    06 Format and referencing

    Document structure

    Your submission should have the following structure:

    1. Title page — with your name, student ID, course code (COMP 6660), assignment title ("Assignment 3 — Enterprise Security Governance and Cyber Resilience"), submission date, and word count for each part.
    2. Table of contents — with page numbers.
    3. Part A — Research paper — with its own title, abstract (150–200 words), and section headings.
    4. Part B — Technical questions — with each question reproduced as a heading, followed by your answer.
    5. References — a single reference list covering both parts, formatted according to the referencing style you have chosen.
    6. Appendices — if you wish to include governance structures, risk registers, incident response flowcharts, resilience architectures, or AI governance frameworks that do not fit within the word count.

    Referencing

    You must cite all sources you use, in accordance with an accepted referencing style. Choose one style — APA 7th edition, IEEE, or Harvard — and apply it consistently across both parts.

    When referencing standards and frameworks, cite the specific document and section where possible:

    • Standards — for example, NIST CSF 2.0, ISO/IEC 27001:2022, NIST SP 800-207, NIST SP 800-61, NIST SP 800-82, ISO/IEC 22301, ISO/IEC 42001, IEC 62443, and equivalent.
    • Peer-reviewed sources — journal articles, conference proceedings, and scholarly monographs.
    • Authoritative industry sources — CISA, ENISA, NCSC, and equivalent bodies; sector regulators; the major annual industry reports.
    • Vendor documentation — where necessary, but should not form the primary basis for technical arguments.

    Use of diagrams and tables

    Diagrams and tables are encouraged. They are particularly important for technical question 1 (governance structures), technical question 2 (risk assessment), technical question 3 (incident response flow), and technical question 4 (resilience architecture). Diagrams should be your own work, should be clearly labelled, and should be referenced in the text.

    Word count

    The word count includes the main body of your answers but excludes the title page, table of contents, references, appendices, and figure captions. Each part has its own word count range — please observe both.

    07 Overall marking rubric

    Assignment 3 is marked out of 100. The overall mark comprises the weighted total of the Part A and Part B criteria, scaled to the assignment weight.

    Assignment 3 — overall weighting
    Component Weight Description
    Part A — Research paper 50% Research paper on cybersecurity governance and risk management in large enterprises.
    Part B — Technical questions 50% Five technical questions, each worth 10% of the assignment mark.

    Grade descriptors

    Grade descriptors
    Grade Range Description
    A (Excellent) 85–100% Demonstrates comprehensive and precise understanding; original and sophisticated analysis; extensive and well-integrated use of scholarly sources; clear, precise, and professional academic communication. Answers address the questions with insight and depth, identify trade-offs and limitations, and reach well-justified conclusions.
    B (Good) 70–84% Demonstrates strong understanding and competent analysis; appropriate use of scholarly sources; clear and well-structured communication. Answers address the questions fully, though with less depth, originality, or nuance than an A-grade submission.
    C (Satisfactory) 60–69% Demonstrates adequate understanding; basic analysis; some use of scholarly sources; clear but sometimes imprecise communication. Answers address the questions but may be superficial, may not fully engage with trade-offs, or may lack original insight.
    D (Marginal) 50–59% Demonstrates limited understanding; weak analysis; limited use of scholarly sources; communication difficulties. Answers address parts of the questions but may contain technical inaccuracies, may lack justification for design decisions, or may omit key components.
    F (Unsatisfactory) 0–49% Does not demonstrate understanding of the material; minimal or no analysis; inadequate or absent sources; unclear communication. Answers do not address the questions, contain significant technical errors, or are substantially incomplete.

    08 Academic integrity

    This assignment must be your own work. You must not:

    • Copy from another student. Collaboration on the assignment is not permitted except where explicitly approved by the instructor.
    • Copy from published sources without citation. All use of others' work — including paraphrasing and summarising — must be properly cited. Copying passages verbatim without quotation and citation is plagiarism.
    • Reuse work submitted for another course. Submission of substantially the same work for multiple courses is not permitted without prior approval.
    • Use generative AI to produce the assignment. The use of AI tools is permitted for specific purposes as set out below — but the intellectual work must be your own.

    All submissions will be checked through plagiarism detection software. Suspected cases of academic misconduct will be handled in accordance with the university's academic integrity policy.

    What is acceptable and what is not

    Acceptable: Discussing the material with classmates; using AI tools for editing, for improving grammar, or for suggesting structure; using AI tools for generating questions you then research and answer yourself; using AI tools as a research aid (e.g. to find sources you then read yourself).

    Not acceptable: Submitting text generated by AI as your own; using AI to write your analysis, your arguments, your design decisions, or your conclusions; using AI to generate citations without reading the sources; using AI to complete any part of the assignment that constitutes the intellectual work.

    09 Use of AI tools

    The use of generative AI tools in this course is permitted within defined boundaries. The purpose of these boundaries is to ensure that your learning — and your assessed work — reflect your own understanding and your own intellectual effort. Given that Assignment 3 includes an evaluation of AI in enterprise cybersecurity, take particular care to distinguish between your own analysis and any AI-generated content.

    Permitted uses

    • Editing and proofreading. Using AI to check grammar, spelling, clarity, and consistency.
    • Structural suggestions. Using AI to suggest how a section might be structured — which you then implement in your own words.
    • Research assistance. Using AI to suggest search terms, to identify possible sources, or to generate questions — provided you then locate and read the original sources yourself.
    • Explaining concepts. Using AI to help you understand a concept you are struggling with — provided you then apply the concept yourself.
    • Generating counterarguments. Using AI to suggest counterarguments to your thesis — which you then evaluate yourself and incorporate if appropriate.

    Not permitted

    • Generating assignment text. Submitting AI-generated text as your own work, in whole or in part.
    • Generating analysis or arguments. Using AI to produce the analysis, the arguments, the design decisions, or the conclusions of your assignment.
    • Generating citations. Including citations to sources you have not read, or that AI has generated without verification.
    • Completing any assessed intellectual work. Any part of the assignment that requires you to understand, to analyse, to design, or to conclude must be your own work.

    Disclosure

    Where you have used AI tools in completing this assignment, you must disclose the use in a short statement at the end of the assignment:

    • Which AI tools you used.
    • For which purposes you used them.
    • How the output was used — for example, "used for grammar checking," "used to suggest structural options I then evaluated."
    • Confirmation that the intellectual work — the research, the analysis, the design, the argument, and the conclusions — is your own.

    Failure to disclose AI use where it has occurred may be treated as academic misconduct.

    Using AI responsibly

    AI tools can be valuable as aids — as a research assistant, as a writing coach, as a source of challenge to your thinking. They cannot be a substitute for your understanding, and they cannot be a substitute for your intellectual work. This is especially true for this assignment, which asks you to reason about AI itself — a reasoning task that requires your own critical judgement.

    10 Support and resources

    Course resources

    • Unit 6 lessons — governance, policy, risk management, compliance, awareness, audit, incident response, continuity, resilience, and emerging trends — Lessons 6.1–6.10.
    • Earlier units — the foundations, technologies, threats, architecture, and infrastructure material examined in Units 1–5, drawn on by the integrative technical questions in this assignment.
    • Unit resources page — the Unit 6 resources — with recommended standards, papers, and industry sources.
    • Unit discussion — the Unit 6 forum — where you can discuss the material with classmates.

    Standards and frameworks

    • NIST CSF 2.0 — the Cybersecurity Framework.
    • ISO/IEC 27001:2022 — the ISMS standard.
    • ISO/IEC 27002:2022 — the control catalogue.
    • ISO/IEC 27005 — Information security risk management.
    • NIST SP 800-207 — Zero Trust Architecture.
    • NIST SP 800-53 — the control catalogue.
    • NIST SP 800-61 — Computer Security Incident Handling Guide.
    • NIST SP 800-82 — Guide to Industrial Control Systems Security.
    • NIST SP 800-34 — Contingency Planning Guide.
    • NIST AI RMF — the AI Risk Management Framework.
    • ISO/IEC 22301 — Business continuity management systems.
    • ISO/IEC 22316 — Organizational resilience.
    • ISO/IEC 42001 — AI management systems.
    • IEC 62443 — Industrial automation and control systems security.
    • The IIA Standards — the Institute of Internal Auditors' professional standards.
    • COBIT — ISACA's IT governance framework.
    • The EU AI Act — regulation of AI systems.
    • DORA — the EU Digital Operational Resilience Act.
    • NIS2 — the EU Network and Information Security Directive 2.
    • CISA #StopRansomware — ransomware guidance.
    • ENISA Threat Landscape — the annual EU threat assessment.

    Academic skills support

    • Library services — for help with literature search, with database access, and with source evaluation.
    • Writing centre — for help with academic writing, with structure, and with referencing.
    • Study skills support — for help with time management, with reading strategies, and with exam preparation.
    • Accessibility services — for support with any adjustments you require.

    Contact

    • Course instructor — for questions about the assignment brief, about content, or about extensions. Contact through Brightspace or at the address provided in the syllabus.
    • Teaching assistants — for questions about course material and about assignment expectations. Contact details are available in Brightspace.
    • Technical support — for problems with Brightspace or with submission.

    Getting help early

    If you have questions about the assignment, ask early — the instructor and teaching assistants are here to help, and it is much easier to help with a question than with a completed assignment that has taken the wrong approach. If you are struggling with any aspect of the assignment, contact the instructor before the due date — do not wait until you are out of time.

    11 Preparation checklist

    Use the checklist below to plan and to verify your work. It is not exhaustive, but it identifies the principal requirements.

    Before you begin

    • Read the assignment brief in full.
    • Review Unit 6 in full, and revisit the Units 1–5 material that the technical questions draw on.
    • Identify the specific lessons that address each question.
    • Plan your time — this assignment requires 30–35 hours of focused work.
    • Locate the standards and frameworks you will need — particularly the primary documents for NIST CSF 2.0, ISO/IEC 27001, and NIST SP 800-207.

    Research paper (Part A)

    • Read at least 12 scholarly or authoritative sources — of which at least 6 are peer-reviewed or from standards bodies.
    • Read the primary framework documents — NIST CSF 2.0, ISO/IEC 27001:2022, and NIST SP 800-207 — in full or in substantial part.
    • Take notes with citations as you read.
    • Develop a clear thesis — the paper's original argument on integration.
    • Structure the paper with clear sections and logical progression.
    • Engage with the integration question critically — be specific about where the frameworks overlap, complement, and conflict.
    • Include a conclusion that follows from the analysis.
    • Check the word count (2,000–2,500 words, excluding references and appendices).

    Technical questions (Part B)

    • Answer all five questions.
    • Each answer is approximately 300–400 words.
    • Each answer addresses all components of the question.
    • Design decisions are justified with reference to the course material and to published guidance.
    • Trade-offs, limitations, and organisational challenges are acknowledged.
    • Diagrams are included where appropriate — particularly for questions 1, 2, 3, and 4.
    • Total word count for Part B is 1,500–2,000 words.

    Formatting and referencing

    • Title page with name, student ID, course code, assignment title, submission date, and word count.
    • Table of contents with page numbers.
    • Both parts are clearly identified.
    • Every citation is matched by a full reference.
    • Every reference is cited in the text.
    • Consistent referencing style throughout (APA 7th, IEEE, or Harvard).
    • Consistent formatting throughout.
    • PDF file name is correct (COMP660_Assignment3_LastName_FirstName.pdf).

    Integrity and disclosure

    • All work is your own.
    • All sources are cited.
    • Where AI tools have been used, the use is disclosed in accordance with the requirements set out above.
    • You have read and understood the academic integrity policy.

    Final submission

    • Assignment is submitted through Brightspace as a single PDF.
    • Submission is before the due date — or an extension has been approved.
    • You have kept a copy of your submission.

    A final note

    Assignment 3 is the integrative assignment for COMP 6660. It asks you to reason about governance, about risk, about resilience, and about the strategic implications of emerging technology — and to integrate the material you have examined across the whole course. Approach it as a piece of scholarly work — researched, reasoned, and carefully communicated. The capability you develop in this assignment — to design governance frameworks, to conduct risk assessments, to develop incident response plans, to design resilience strategies, and to reason about the strategic implications of emerging technology — is the capability that enterprise cybersecurity practice requires of its most senior practitioners.

    👤