Module 3 · Unit 6 · Outcomes & Mapping
COMP 6660 · Enterprise Cybersecurity Module 3 Learning Outcomes
The authoritative learning outcomes for Module 3 — Governance, Operations, and Enterprise Resilience — together with their mapping to the nine course learning outcomes and the assessment components that verify them.
01 Module learning outcomes
Upon successful completion of Module 3, students will be able to:
Governance & risk
- M3.1 — Develop cybersecurity governance frameworks and supporting policy hierarchies.
- M3.2 — Conduct risk assessments using recognised risk-management frameworks.
- M3.3 — Conduct compliance assessments against regulatory and standards-based requirements.
- M3.4 — Evaluate security awareness and human-factor programmes.
- M3.5 — Plan and support cybersecurity auditing activities.
Operations & resilience
- M3.6 — Design incident-response processes and enterprise incident-response plans.
- M3.7 — Develop business continuity and disaster recovery strategies.
- M3.8 — Develop cyber-resilience strategies for enterprise recovery.
Emerging issues & scholarship
- M3.9 — Assess emerging cybersecurity technologies, trends, and governance challenges.
- M3.10 — Evaluate the opportunities and risks of artificial intelligence in enterprise cybersecurity.
- M3.11 — Communicate governance and resilience findings in scholarly form.
How to read these outcomes
The module outcomes above are the authoritative statements for assessment purposes. They are drawn directly from the unit-level outcomes and are verified by Assignment 3, the graded discussion forum in this module, and Part C of the final examination. The unit-level statements appear in Section 02 below.
02 Unit 6 — Enterprise Cybersecurity Governance, Risk, and Compliance
Upon completion of Unit 6, students will be able to:
Unit 6 learning outcomes
- U6.1 — Develop governance frameworks.
- U6.2 — Conduct compliance assessments.
- U6.3 — Design incident-response processes.
- U6.4 — Develop cyber-resilience strategies.
Unit 6 outcomes are managerial and strategic. They are assessed primarily through Assignment 3, Forum 6, and Part C of the final examination. The table below shows where each outcome is introduced and assessed.
| Outcome | Introduced in | Developed in | Assessed by |
|---|---|---|---|
| U6.1 — Governance frameworks | Lesson 6.1 | Lessons 6.1–6.6 | Forum 6; Assignment 3 (Q1); Final exam Part C |
| U6.2 — Compliance assessments | Lesson 6.4 | Lessons 6.4–6.6 | Forum 6; Assignment 3 (Q2); Final exam Part C |
| U6.3 — Incident-response processes | Lesson 6.7 | Lessons 6.7–6.8 | Assignment 3 (Q3); Final exam Part C |
| U6.4 — Cyber-resilience strategies | Lesson 6.9 | Lessons 6.9–6.10 | Forum 6; Assignment 3 (Q4, Q5); Final exam Part C |
03 Mapping to course learning outcomes
Module 3 develops and assesses four of the nine course learning outcomes. The table below shows the coverage level for each course outcome and where the mapping is assessed. The authoritative course-level statements are published on the course learning outcomes page.
| CLO | Statement | Coverage in Module 3 | Assessed by |
|---|---|---|---|
| CLO1 | Define the scope, objectives, principles, and strategic importance of enterprise cybersecurity. | Reinforced at strategic level | Final exam Part A |
| CLO2 | Analyse threats, vulnerabilities, risks, and attack vectors. | Reinforced (risk assessment) | Assignment 3 (Q2); Final exam Part C |
| CLO3 | Evaluate and apply cryptographic, authentication, authorization, and access-control technologies. | Not addressed | Modules 1 and 2 |
| CLO4 | Design and assess enterprise cybersecurity architectures and controls. | Applied (governance of architecture) | Assignment 3; Final exam Part C |
| CLO5 | Apply cybersecurity principles to secure enterprise systems, networks, cloud environments, and digital services. | Applied (resilience and continuity) | Assignment 3 (Q3, Q4); Final exam Part C |
| CLO6 | Develop cybersecurity governance, risk-management, compliance, and policy frameworks. | Developed and assessed | Forum 6; Assignment 3 (Q1, Q2); Final exam Part C |
| CLO7 | Evaluate incident response, business continuity, disaster recovery, and cyber-resilience strategies. | Developed and assessed | Assignment 3 (Q3, Q4); Final exam Part C |
| CLO8 | Assess emerging cybersecurity technologies, trends, and challenges. | Developed and assessed | Forum 6; Assignment 3 (Q5); Final exam Part B |
| CLO9 | Conduct scholarly research and communicate cybersecurity findings effectively. | Assessed | Forum 6; Assignment 3; Final exam Part C |
Coverage levels
Developed means the outcome receives substantial treatment here. Assessed means student performance against the outcome is formally graded within Module 3. Applied or reinforced means the outcome is used in a new context, building on prior modules.
04 Assessment alignment
Module 3 outcomes are verified by the following assessment components. Every module outcome is assessed at least once, and most are assessed by more than one component.
20%
Assignment 3
Enterprise Security Governance and Cyber Resilience. Covers M3.1–M3.11. Five technical questions plus a research essay integrating NIST CSF, ISO/IEC 27001, and Zero Trust.
~2%
Forum 6
The final graded discussion forum, contributing to the 10% online participation component. Covers M3.1, M3.3, M3.4, M3.8, M3.9, and M3.10.
30%
Final examination
All units and learning outcomes. Module 3 material is central to Part C (40% of the examination), the enterprise case study, and contributes to Part B.
| Outcome | Forum 6 | Assignment 3 | Final exam |
|---|---|---|---|
| M3.1 — Governance frameworks | ✓ | ✓ | ✓ |
| M3.2 — Risk assessment frameworks | — | ✓ | ✓ |
| M3.3 — Compliance assessment | ✓ | ✓ | ✓ |
| M3.4 — Awareness and human factors | ✓ | — | — |
| M3.5 — Cybersecurity auditing | — | — | ✓ |
| M3.6 — Incident-response processes | ✓ | ✓ | ✓ |
| M3.7 — Business continuity and DR | — | ✓ | ✓ |
| M3.8 — Cyber-resilience strategies | ✓ | ✓ | ✓ |
| M3.9 — Emerging trends | ✓ | ✓ | ✓ |
| M3.10 — AI in cybersecurity | ✓ | ✓ | ✓ |
| M3.11 — Scholarly communication | ✓ | ✓ | ✓ |
Final examination weighting
Part C of the final examination (40% of the exam mark) presents an enterprise case study requiring risk assessment, architectural analysis, governance considerations, and strategic recommendations. All four elements draw directly on Module 3 outcomes, particularly M3.1–M3.3 and M3.6–M3.8.
05 Progression and integration
Module 3 outcomes integrate the whole course. Each Module 3 outcome builds on prior modules and, in most cases, requires students to draw on material from across the course.
- M3.1–M3.3 — Governance, risk, compliance Builds on Module 1 outcomes M1.4 and M1.5 (frameworks and posture) and Module 2 outcomes M2.2 and M2.5 (risk and architecture). Requires students to reason about how technical controls are governed.
- M3.4–M3.5 — People and assurance Builds on Module 1 outcomes M1.1–M1.3 (objectives and assets) and Module 2 outcomes M2.6 and M2.7 (detection and controls). Requires students to evaluate whether controls actually work in practice.
- M3.6–M3.8 — Operations and resilience Builds on Module 2, Units 3 and 4 (threats and architecture). Requires students to design response and recovery processes that integrate with the technical controls studied earlier.
- M3.9–M3.10 — Emerging issues Builds on Module 2 outcomes M2.9 and M2.10 (platform and emerging threats). Requires students to evaluate AI governance and other forward-looking challenges.
- M3.11 — Scholarly communication Developed across Modules 1 and 2 through the forums and assignments, and formally assessed in Assignment 3 and the final examination.
Mastery of Module 3 outcomes
Students who can develop a governance framework for a specific organisational context, conduct a risk and compliance assessment, design an incident-response plan, and articulate a cyber-resilience strategy are ready for the final examination. These capabilities also distinguish the course's graduates from technical specialists who have not studied governance.
Why does Module 3 have more module outcomes than Module 2?
Module 3 covers governance, risk, compliance, awareness, auditing, incident response, continuity, resilience, and emerging trends — a wide range of distinct capabilities within a single unit. Because the unit spans so much ground, its outcomes are more granular than those in Module 2, which is more integrated.
Are the module outcomes identical to the unit outcomes?
No. Unit 6 has four broad outcomes (governance frameworks, compliance assessments, incident-response processes, resilience strategies). Module 3 has eleven more specific outcomes that unpack those four and add outcomes relating to awareness, auditing, emerging trends, AI, and scholarly communication.
How does CLO7 relate to Module 2's detection material?
CLO7 covers incident response, business continuity, disaster recovery, and resilience. Module 2 introduces the detection and response elements through Unit 4, Lessons 4.6–4.7 (IDS, IPS, SIEM, XDR, SOC operations). Module 3 develops the broader governance and resilience dimensions that CLO7 requires, drawing on that technical foundation.
What is the relationship between M3.2 and the risk material in Unit 3?
Unit 3, Lessons 3.1–3.3 treat risk as an analytical problem: how to identify, model, and assess it. M3.2 treats risk as a governance problem: how to structure risk management as an organisational process, who owns treatment decisions, and how risk is reported to the board. Both perspectives are examinable, and Assignment 3 requires students to connect them.
Which outcomes should I prioritise for the final examination?
Prioritise M3.1 (governance frameworks), M3.3 (compliance assessment), M3.6 (incident response), M3.7 (business continuity and DR), M3.8 (cyber resilience), and M3.9–M3.10 (emerging trends and AI). These are the outcomes most heavily weighted in Part C of the final examination. M3.2 and M3.5 are also examinable but tend to be integrated with M3.1 and M3.3.
Where can I find the course-level outcomes?
The nine course learning outcomes are published on the course learning outcomes page, along with their full statements and the mapping to assessments. The course syllabus carries the authoritative assessment scheme and schedule.