Module 3 · Unit 6 · 10 Lessons
COMP 6660 · Enterprise Cybersecurity Governance, Operations, and Enterprise Resilience
Addresses the managerial, regulatory, and operational side of enterprise security: governance and policy, risk and compliance, security awareness and auditing, incident response, business continuity and disaster recovery, cyber resilience, and emerging trends including AI.
01 Module overview
Module 3 closes the course by moving from technology to accountability: who owns security, how it is governed, how it is assured, and how the enterprise survives and recovers when prevention fails.
The module is delivered as a single substantial unit, Unit 6, comprising ten lessons. It begins with cybersecurity governance — board and executive accountability, security strategy, organisational structures, and the policy hierarchy that translates intent into enforceable standards. It then examines risk-management frameworks and the compliance and regulatory landscape, including the reporting obligations that increasingly shape enterprise behaviour.
The middle of the unit addresses people and assurance: security awareness programmes and human factors, and cybersecurity auditing as an independent check on control effectiveness. The final third turns to failure and recovery: incident-response planning, business continuity and disaster recovery, cyber resilience and enterprise recovery, and emerging trends — including the governance implications of artificial intelligence in enterprise security.
Module 3 integrates concepts from the whole course. Students are expected to connect governance decisions to the technical architectures studied in Module 2, and to frame recommendations in terms of risk, cost, and organisational capability. The module is assessed through Assignment 3, the final discussion forum, and Part C of the final examination.
| Module | 3 — Governance, Operations, and Enterprise Resilience |
|---|---|
| Units | Unit 6 |
| Lessons | 10 |
| Discussion forum | Forum 6 (Unit 6) |
| Assessment | Assignment 3 — Enterprise Security Governance and Cyber Resilience (20%) |
| Recommended weeks | Weeks 12–13 (review in week 14) |
| Primary CLOs | CLO6, CLO7, CLO8 |
02 Module learning outcomes
Upon successful completion of Module 3, students will be able to:
Governance & Risk
- Develop cybersecurity governance frameworks and supporting policy hierarchies.
- Conduct risk assessments using recognised risk-management frameworks.
- Conduct compliance assessments against regulatory and standards-based requirements.
- Evaluate security awareness and human-factor programmes.
- Plan and support cybersecurity auditing activities.
Operations
- Design incident-response processes and enterprise incident-response plans.
- Develop business continuity and disaster recovery strategies.
- Develop cyber-resilience strategies for enterprise recovery.
Emerging Issues & Scholarship
- Assess emerging cybersecurity technologies, trends, and governance challenges.
- Evaluate the opportunities and risks of artificial intelligence in enterprise cybersecurity.
- Communicate governance and resilience findings in scholarly form.
Full statement
The authoritative module learning outcomes, including their mapping to the nine course learning outcomes, are published on the Module 3 learning outcomes page.
| CLO | Statement | Coverage in Module 3 |
|---|---|---|
| CLO1 | Define the scope, objectives, principles, and strategic importance of enterprise cybersecurity. | Reinforced at strategic level (Unit 6) |
| CLO6 | Develop cybersecurity governance, risk-management, compliance, and policy frameworks. | Developed and assessed (Unit 6) |
| CLO7 | Evaluate incident response, business continuity, disaster recovery, and cyber-resilience strategies. | Developed and assessed (Unit 6) |
| CLO8 | Assess emerging cybersecurity technologies, trends, and challenges. | Developed and assessed (Unit 6) |
| CLO9 | Conduct scholarly research and communicate findings effectively. | Practised (Assignment 3, Forum 6, final exam) |
03 Unit in this module
Module 3 contains a single unit. It provides an overview page, a learning outcomes page, ten lessons, a graded discussion forum, and a curated resource list.
Unit 6 — Enterprise Cybersecurity Governance, Risk, and Compliance
Examines how enterprises direct, assure, and sustain their security programmes: governance and policy, risk and compliance, awareness and auditing, incident response, continuity and recovery, resilience, and the emerging issues reshaping the field.
Unit learning outcomes
- Develop governance frameworks.
- Conduct compliance assessments.
- Design incident-response processes.
- Develop cyber-resilience strategies.
Cybersecurity Governance
Board and executive accountability, security strategy, operating models, and the three lines of defence.
Lesson 6.2Security Policies and Standards
The policy hierarchy — policy, standard, procedure, guideline — and how to make it enforceable.
Lesson 6.3Risk Management Frameworks
NIST RMF, ISO 31000 and ISO/IEC 27005, risk treatment, and communicating risk to decision-makers.
Lesson 6.4Compliance and Regulatory Requirements
Privacy, sectoral, and breach-notification obligations, and the difference between compliance and security.
Lesson 6.5Security Awareness and Human Factors
Behavioural drivers, awareness programme design, measurement, and reducing reliance on user vigilance.
Lesson 6.6Cybersecurity Auditing
Audit scope and evidence, control testing, assurance reporting, and responding to findings.
Lesson 6.7Incident Response Planning
Preparation, detection and analysis, containment, eradication, recovery, and post-incident review.
Lesson 6.8Business Continuity and Disaster Recovery
Business impact analysis, RTO and RPO, recovery strategies, and exercising the plan.
Lesson 6.9Cyber Resilience and Enterprise Recovery
Designing for degradation and recovery, crisis leadership, and learning from major incidents.
Lesson 6.10Emerging Trends and Future Directions
AI in cybersecurity, digital sovereignty, quantum risk, and the evolving regulatory landscape.
04 Discussion and assessment
Discussion forum
Module 3 hosts the final graded discussion forum. It requires an initial contribution of approximately 300–500 words, supported by scholarly sources, plus at least two meaningful peer responses.
- Forum 6 — Cybersecurity Governance and Resilience. NIST CSF versus ISO 27001; incident response practices; AI and cybersecurity governance. Open Forum 6 →
Participation is worth 10% of the final grade overall.
Assignment 3 (20%)
Enterprise Security Governance and Cyber Resilience — covers Unit 6 and integrated course concepts.
Research topic: Cybersecurity Governance and Risk Management in Large Enterprises: Integrating NIST CSF, ISO/IEC 27001, and Zero Trust Principles.
Technical questions include:
- Develop a cybersecurity governance framework for a university.
- Perform a cybersecurity risk assessment for critical infrastructure.
- Develop an enterprise ransomware incident-response plan.
- Design a business continuity and disaster recovery strategy.
- Evaluate the opportunities and risks of artificial intelligence in enterprise cybersecurity.
Final examination
The final examination (30%) covers all units and learning outcomes. Part C (40% of the exam) presents an enterprise case study requiring risk assessment, architectural analysis, governance considerations, and strategic recommendations — drawing directly on the governance and resilience material in this module. Examination brief →