COMP 6660 · Enterprise Cybersecurity Module 3 — Governance, Operations, and Enterprise Resilience

01 Purpose and position in the course

Module 3 closes the course by moving from technology to accountability. It asks who owns security, how it is governed, how it is assured, and how the enterprise recovers when prevention fails.

Modules 1 and 2 develop a technical and analytical understanding of enterprise cybersecurity. That understanding is necessary but not sufficient. Enterprises do not fail to secure themselves primarily because they lack technology; they fail because accountability is diffuse, risk is not communicated in terms that support investment, assurance is absent, and recovery has not been planned. Module 3 addresses those failures directly.

The module is delivered as a single substantial unit — Unit 6 — comprising ten lessons. It is structured in three movements. Lessons 6.1–6.4 address governance, policy, risk, and compliance: the structures through which an enterprise directs and constrains its security effort. Lessons 6.5–6.6 address people and assurance: awareness, human factors, and independent auditing. Lessons 6.7–6.10 address failure and recovery: incident response, business continuity and disaster recovery, cyber resilience, and the emerging trends reshaping the field.

Throughout, students are expected to integrate concepts from the whole course. Governance decisions resolve into the architectures studied in Module 2. Incident-response planning depends on the detection capabilities studied in Unit 4. Resilience strategy is only meaningful in light of the threat classes studied in Unit 3. Module 3 is where those connections are made explicit and assessed.

02 Module learning outcomes

Module 3 contributes to the course learning outcomes through a set of module outcomes drawn from Unit 6. Upon successful completion of the module, students will be able to:

03 Structure and recommended sequence

The module runs across weeks 12–13, with week 14 reserved for final review and the examination. Because Unit 6 is a single unit with ten lessons, the sequence below groups the lessons into three movements.

1. Governance, policy, and risk — Lessons 6.1–6.3 Cybersecurity governance and accountability; security policies and standards; risk-management frameworks including NIST RMF, ISO 31000, and ISO/IEC 27005.
2. Compliance — Lesson 6.4 Regulatory and sectoral obligations; privacy and breach-notification regimes; the distinction between compliance and security.
3. People and assurance — Lessons 6.5–6.6 Security awareness and human factors; cybersecurity auditing, control testing, and assurance reporting.
4. Forum 6 — Cybersecurity Governance and Resilience Initial contribution plus two peer responses on NIST CSF versus ISO 27001, incident-response practice, or AI governance.
5. Incident response — Lesson 6.7 The incident-response lifecycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident review.
6. Continuity and recovery — Lessons 6.8–6.9 Business impact analysis, RTO and RPO, recovery strategies; designing for degradation and recovery, crisis leadership, and organisational learning.
7. Emerging trends — Lesson 6.10 AI in cybersecurity, digital sovereignty, quantum risk, and the evolving regulatory landscape.
8. Assignment 3 — Enterprise Security Governance and Cyber Resilience Research essay integrating NIST CSF, ISO/IEC 27001, and Zero Trust, plus five applied technical questions. Worth 20% of the final grade.
9. Final examination All units and learning outcomes. Part C (40%) presents an enterprise case study requiring risk assessment, architectural analysis, governance considerations, and strategic recommendations.

04 Unit in detail

05 Key concepts and recurring themes

Module 3 introduces the governance, assurance, and resilience vocabulary that distinguishes a graduate-level security practitioner from a technical specialist. The concepts below recur throughout the unit and the assessment.

Accountability cannot be delegated to technology

Boards and executives remain accountable for security outcomes regardless of how much is outsourced to vendors or delegated to a CISO. Governance is the structure through which that accountability is exercised.

The policy hierarchy

Policy states intent; standards define mandatory requirements; procedures describe how to comply; guidelines offer recommended practice. Confusing these levels produces documents that are either unenforceable or unnecessarily rigid.

Risk appetite as a decision instrument

A stated risk appetite converts security from a technical judgement into a governed business decision. Without it, risk acceptance is ad hoc and post-incident accountability becomes contested.

Compliance is not security

An organisation can satisfy every requirement in a standard and still be breached. Compliance provides structure and assurance; it does not substitute for risk-based judgement.

Three lines of defence

Management owns and operates controls; risk and compliance functions provide oversight; internal audit provides independent assurance. Collapsing these roles destroys the independence on which assurance depends.

Incident response is a rehearsed capability

Plans that have never been exercised routinely fail in practice. Tabletop exercises, defined decision authorities, and pre-approved communications are what distinguish a plan from a document.

Resilience is designed, not discovered

The ability to degrade gracefully, recover within stated objectives, and learn from incidents is an architectural and organisational property. It must be designed in advance and tested regularly.

AI governance is a live problem

Artificial intelligence both strengthens and complicates enterprise security. Governance frameworks are still maturing, and organisations are making adoption decisions with incomplete assurance.

06 How Module 3 is assessed

07 Study guidance