COMP 6660 · Enterprise Cybersecurity Unit 6 — Enterprise Cybersecurity Governance, Risk, and Compliance

01 Purpose of this unit

Modules 1 and 2 built the technical and analytical apparatus. Unit 6 asks the question that determines whether any of it survives contact with a real enterprise: who owns security, how is it governed, how is it assured, and how does the organisation recover when prevention fails?

Enterprises do not fail to secure themselves primarily because they lack technology. They fail because accountability is diffuse, risk is not communicated in terms that support investment, assurance is absent, and recovery has not been planned. Unit 6 addresses those failures directly.

The unit is deliberately structured in three movements. The first — Lessons 6.1 to 6.4 — addresses governance, policy, risk, and compliance: the structures through which an enterprise directs and constrains its security effort. Students examine board and executive accountability, the policy hierarchy, risk-management frameworks, and the regulatory and compliance landscape, including the distinction between being compliant and being secure.

The second movement — Lessons 6.5 and 6.6 — addresses people and assurance. It examines why awareness programmes fail, how behavioural drivers shape risk, and how to design and measure programmes that reduce reliance on user vigilance. It then introduces cybersecurity auditing as an independent check on control effectiveness: audit scope and evidence, control testing, assurance reporting, and the discipline of responding to findings constructively.

The third movement — Lessons 6.7 to 6.10 — addresses failure and recovery: incident-response planning across the full lifecycle, business continuity and disaster recovery, cyber resilience and enterprise recovery, and the emerging trends reshaping the field — including the governance implications of artificial intelligence in enterprise security.

Throughout, students are expected to integrate concepts from the whole course. Governance decisions resolve into the architectures studied in Module 2. Incident-response planning depends on the detection capabilities studied in Unit 4. Resilience strategy is only meaningful in light of the threat classes studied in Unit 3. Unit 6 is where those connections are made explicit and assessed.

02 Topics covered

The unit addresses ten topics, each corresponding to one lesson. The topics are grouped into three movements: governance and risk (6.1–6.4), assurance and people (6.5–6.6), and operations and resilience (6.7–6.10).

03 Lessons in this unit

Unit 6 contains ten lessons. Each provides readings, a set of core concepts, worked examples where useful, and one or more applied activities.

04 Key concepts

The concepts below are introduced or reinforced in Unit 6. They distinguish the course's graduates from technical specialists who have not studied governance, and they recur throughout the assessment.

Governance

The structures, processes, and accountabilities through which an enterprise directs and controls its activities. In cybersecurity, governance ensures that security is aligned with business objectives, that risk is managed at the appropriate level, and that accountability is clear.

Three lines of defence

A governance model that separates management (first line — owns and operates controls), risk and compliance functions (second line — provide oversight), and internal audit (third line — provides independent assurance). Collapsing these roles destroys the independence on which assurance depends.

Policy hierarchy

The layered structure of security documentation: policy states intent; standards define mandatory requirements; procedures describe how to comply; guidelines offer recommended practice. Confusing these levels produces documents that are either unenforceable or unnecessarily rigid.

Risk appetite

The amount and type of risk an organisation is willing to accept in pursuit of its objectives. Set by governance, not by security teams. Converts security from a technical judgement into a governed business decision.

Risk treatment

The action taken in response to assessed risk: avoid (eliminate the activity), mitigate (reduce likelihood or impact), transfer (insurance or contract), or accept (retain with awareness). Choice of treatment is a governance decision.

Compliance versus security

An organisation can satisfy every requirement in a standard and still be breached. Compliance provides structure and assurance; it does not substitute for risk-based judgement.

Breach notification

The regulatory obligation to inform regulators and, in many cases, affected individuals when personal or sensitive data is compromised. Deadlines and thresholds vary by jurisdiction, and compliance is often more complex than it appears.

Security awareness programme

A structured effort to improve security behaviour across the workforce. Effective programmes are designed around behavioural drivers, measured, and integrated with other controls — not treated as annual training.

Cybersecurity audit

An independent examination of security controls, processes, and compliance against defined criteria. Produces evidence-based findings and assurance that the governing body can rely on.

Incident response lifecycle

The structured sequence of activities following a security incident: preparation, detection and analysis, containment, eradication, recovery, and post-incident review. Plans that have never been exercised routinely fail in practice.

Business impact analysis (BIA)

The process of identifying and prioritising the business functions whose disruption would cause the greatest harm. Produces the recovery objectives (RTO, RPO) against which continuity and recovery strategies are designed.

Recovery Time Objective (RTO) / Recovery Point Objective (RPO)

RTO is the maximum acceptable time to restore a function after disruption. RPO is the maximum acceptable data loss measured in time. Both are business decisions, not technical ones.

Cyber resilience

The ability of an enterprise to withstand, adapt to, and recover from cyber incidents. Designed in advance and tested regularly; not discovered during an incident.

Crisis leadership

The leadership behaviours required during a major incident: clear decision authority, timely communication, protection of the organisation's people and reputation, and sustained attention over an extended response.

Digital sovereignty

The principle that data and digital infrastructure are subject to the laws and governance of the jurisdiction in which they reside. Increasingly relevant as cloud services and data flows cross national boundaries.

AI governance

The structures and controls used to manage the risks and opportunities of artificial intelligence in the enterprise, including its use in security operations. Still maturing; organisations are making adoption decisions with incomplete assurance.

05 How this unit is assessed

06 Study guidance