Module 3 · Unit 6 · Forum 6
COMP 6660 · Enterprise Cybersecurity Forum 6 — Cybersecurity Governance and Resilience
The sixth and final graded discussion forum. Analyse governance frameworks, incident-response practice, and the emerging governance challenges posed by artificial intelligence.
01 Forum overview
Forum 6 closes the course's discussion sequence. It invites you to analyse the governance, assurance, and resilience questions that determine whether security survives contact with a real enterprise.
The forum runs asynchronously in Brightspace and is the final of six graded forums contributing to the 10% online participation component. It draws most heavily on Lessons 6.1 (Governance), 6.3 (Risk Management), 6.7 (Incident Response), and 6.10 (Emerging Trends).
Forum 6 also supports Assignment 3 and Part C of the final examination. The governance and resilience reasoning developed here is directly applicable to the case study.
Where to post
The forum is hosted in Brightspace, in the Unit 6 Discussion topic under the Discussions tool.
02 Discussion prompts
Choose one of the following prompts.
Prompt A — NIST CSF versus ISO/IEC 27001
NIST CSF and ISO/IEC 27001 are the two most widely adopted cybersecurity frameworks, but they are designed for different purposes. Analyse:
- the origins and design intent of each framework;
- which organisational contexts each is best suited to;
- whether they are complementary or competing;
- how an enterprise should choose between them, or use both.
Support your analysis with at least three scholarly or authoritative sources.
Prompt B — Incident response practice
Incident-response plans that have never been exercised routinely fail in practice. Analyse:
- the structural reasons incident-response plans fail (no decision authority, unclear escalation, untested communications);
- what distinguishes organisations that respond well from those that respond poorly;
- the role of tabletop exercises, red teaming, and crisis simulations;
- whether incident response should be treated as a technical function, a governance function, or both.
Support your analysis with at least three scholarly or authoritative sources.
Prompt C — AI and cybersecurity governance
Artificial intelligence is reshaping both attack and defence, and its governance is still maturing. Analyse:
- the ways AI is changing the threat landscape (AI-enabled attacks, deepfakes, automated reconnaissance);
- the ways AI is changing defensive practice (detection, triage, threat hunting);
- the governance challenges AI creates (model risk, explainability, data provenance, regulatory uncertainty);
- whether existing governance frameworks are adequate to the task.
Support your analysis with at least three scholarly or authoritative sources.
03 Participation requirements
Initial contribution
One substantive posting of approximately 300–500 words that:
- demonstrates understanding of the Unit 6 readings;
- incorporates at least three scholarly sources;
- contributes original analysis;
- links theory to enterprise practice.
Peer responses
At least two meaningful responses to classmates that:
- extend the discussion;
- critically evaluate ideas;
- present alternative perspectives;
- introduce supporting evidence or examples.
Simple agreement is not sufficient.
04 Grading rubric
| Criterion | Weight |
|---|---|
| Relevance and quality of contributions | 30% |
| Critical analysis and reflection | 30% |
| Integration of research evidence | 20% |
| Engagement with peers | 20% |
| Total | 100% |
05 Alignment with unit outcomes
| Outcome | How the forum addresses it |
|---|---|
| U6.1 — Governance frameworks | Prompt A directly compares two dominant governance frameworks. |
| U6.2 — Compliance assessments | Prompt A touches on certification and auditability. |
| U6.3 — Incident-response processes | Prompt B directly addresses incident-response practice. |
| U6.4 — Cyber-resilience strategies | Prompt C addresses AI governance and emerging trends. |
| CLO9 — Scholarly communication | All prompts require scholarly argument supported by sources. |
06 Guidance for a strong contribution
Is NIST CSF or ISO/IEC 27001 "better"?
Neither is universally better — they serve different purposes. NIST CSF is a voluntary framework for organising and improving security programmes; ISO/IEC 27001 is a certifiable standard with specific requirements. A strong Prompt A contribution will explain the design intent of each and identify the contexts in which each is appropriate.
How current does the AI literature need to be?
Very current. AI governance is evolving rapidly, and sources from more than two years ago may already be outdated. Prefer recent regulatory guidance (EU AI Act, NIST AI RMF), industry reports, and peer-reviewed literature from the past 18–24 months.
Can I use a case study from my own organisation?
Yes, if anonymised and free of confidential detail. Real examples often make for stronger contributions, provided they are analysed rather than merely described.
How does Forum 6 help with Assignment 3?
Assignment 3 asks you to develop a governance framework, perform a risk assessment, develop an incident-response plan, design a BCP/DR strategy, and evaluate AI in enterprise cybersecurity. Forum 6 exercises exactly those areas of reasoning.
Is this the last forum of the course?
Yes. Forum 6 is the final graded discussion forum. After completing it, focus on Assignment 3 and on preparing for the final examination.
Course completion
After posting to Forum 6, complete Assignment 3 and prepare for the final examination.