About This Course
In today's hyperconnected digital environment, organisations face an ever-expanding landscape of IT risks — from sophisticated cyber threats and cloud vulnerabilities to third-party exposures and regulatory non-compliance. The consequences of inadequate risk management extend far beyond data breaches: they include operational disruption, financial loss, reputational damage, and legal liability. Organisations that fail to proactively assess and address their IT risks are increasingly finding themselves unprepared for the speed and scale of modern incidents.
The IT Risk Assessment and Mitigation Strategies Training offered by TrainingComplex is a rigorous, five-day programme designed to transform participants into confident risk practitioners capable of leading structured risk assessments and designing effective mitigation architectures. Drawing on globally recognised frameworks — including ISO/IEC 27005, NIST SP 800-30, COBIT 2019, and FAIR — the course blends conceptual grounding with hands-on application, ensuring that participants leave with skills they can deploy immediately in their organisations.
Participants will learn to identify and classify IT assets, conduct threat and vulnerability analyses, calculate risk exposure using quantitative and qualitative methods, and develop risk treatment plans that balance security investment with business objectives. The programme also addresses the governance and communication dimensions of risk management — helping participants engage senior leadership, satisfy audit and compliance requirements, and embed a risk-aware culture within their teams.
Whether you are an IT security analyst seeking to formalise your risk assessment practice, a technology manager responsible for organisational resilience, or a compliance officer navigating a complex regulatory environment, this course provides the structured knowledge and practical tools you need to make sound, evidence-based risk decisions.
Who Should Attend
- IT Security Analysts and Engineers seeking to formalise and deepen their risk assessment capabilities
- IT Managers and CIOs responsible for technology risk governance and enterprise resilience
- Information Security Officers and Risk Officers managing organisational cyber risk programmes
- Compliance and Audit Professionals overseeing IT controls, regulatory requirements, and audit readiness
- Business Continuity and Disaster Recovery Specialists integrating risk data into continuity planning
- Project Managers delivering technology-intensive projects who need to embed risk controls into delivery frameworks
- Consultants and Advisors providing IT governance, risk, and compliance services to client organisations
Learning Objectives
- Explain the principles, terminology, and lifecycle of IT risk management within enterprise governance frameworks
- Apply ISO/IEC 27005, NIST SP 800-30, and FAIR methodologies to real-world IT risk assessment scenarios
- Identify and classify IT assets, assign business value, and map dependencies across the technology environment
- Conduct structured threat identification and vulnerability analysis using industry-standard tools and techniques
- Calculate and communicate risk exposure using both qualitative likelihood-impact matrices and quantitative risk modelling
- Develop prioritised risk treatment plans selecting from avoidance, mitigation, transfer, and acceptance strategies
- Design and evaluate security controls aligned to risk findings and mapped to regulatory requirements
- Build and maintain a risk register suitable for executive reporting, audit review, and continuous monitoring
- Communicate risk findings to technical and non-technical stakeholders using clear, evidence-based reporting formats
- Embed IT risk assessment into organisational change, project delivery, and third-party management processes
Course Modules
Module 1: Foundations of IT Risk Management
- Core concepts: risk, threat, vulnerability, likelihood, and impact defined
- The IT risk management lifecycle from identification to monitoring
- Business drivers for IT risk management: regulatory, strategic, and operational
- Relationship between IT risk management and enterprise risk governance
- Distinguishing inherent risk from residual risk and understanding the role of controls in that transition
- Common failure modes in IT risk programmes: root causes of ineffective risk management and how to avoid them
Module 2: Risk Management Frameworks and Standards
- ISO/IEC 27005: structure, scope, and application in practice
- NIST SP 800-30 risk assessment guide: process steps and outputs
- FAIR (Factor Analysis of Information Risk) for quantitative risk modelling
- COBIT 2019 risk enablers and their integration with IT governance
- Comparing and selecting the right framework or hybrid approach based on organisational size, sector, and regulatory context
- Gaps and limitations in each major standard and how practitioners address them in real-world implementations
Module 3: IT Asset Identification and Classification
- Asset inventory methods: discovery tools, CMDBs, and manual cataloguing
- Classifying assets by type: data, hardware, software, services, and people
- Assigning business value and criticality ratings to IT assets
- Mapping asset dependencies and identifying single points of failure
- Handling shadow IT and unmanaged assets: discovery challenges and governance responses
- Maintaining asset inventory accuracy over time through change management integration and periodic reconciliation
Module 4: Threat Intelligence and Threat Modelling
- Threat actor categories: nation-states, cybercriminals, insiders, and opportunists
- Sources of threat intelligence: OSINT, ISACs, vendor advisories, and dark web monitoring
- Structured threat modelling using STRIDE and PASTA methodologies
- Translating threat intelligence into actionable risk scenarios
- Assessing threat actor capability, intent, and opportunity to calibrate likelihood estimates more precisely
- Integrating threat modelling outputs into secure design reviews and architecture decision records
Module 5: Vulnerability Assessment and Analysis
- Vulnerability scanning tools and techniques: Nessus, OpenVAS, and manual review
- Interpreting CVSS scores and prioritising remediation by business context
- Configuration weaknesses, patch management gaps, and design flaws as vulnerability classes
- Linking vulnerabilities to specific assets and threat scenarios in the risk register
- Using penetration testing and red team findings to validate and supplement automated scanning results
- Tracking vulnerability remediation progress with ageing metrics and SLA-based reporting to drive accountability
Module 6: Risk Analysis: Qualitative and Quantitative Methods
- Likelihood-impact matrix construction and calibration for organisational context
- Semi-quantitative scoring models and their practical advantages
- FAIR-based quantitative analysis: loss event frequency and probable loss magnitude
- Aggregating individual risks into portfolio-level risk exposure views
- Addressing common biases — anchoring, optimism bias, and groupthink — that distort risk scoring in workshop settings
- Validating risk analysis outputs through historical incident data, industry benchmarks, and sensitivity analysis
Module 7: Risk Evaluation and Risk Appetite
- Defining risk appetite and risk tolerance at board and operational levels
- Comparing assessed risk levels against organisational risk appetite thresholds
- Prioritising risks for treatment using risk ranking and heat map visualisation
- Documenting risk evaluation outcomes for governance and audit purposes
- Articulating risk appetite in measurable terms: translating qualitative statements into quantitative thresholds and KRI limits
- Reviewing and recalibrating risk appetite in response to strategic change, significant incidents, or shifts in the external threat landscape
Module 8: Risk Treatment Planning and Control Selection
- The four risk treatment options: avoid, mitigate, transfer, and accept — applied in practice
- Selecting and mapping security controls from ISO 27001 Annex A and NIST CSF
- Developing a risk treatment plan with owners, timelines, and resource estimates
- Residual risk assessment and sign-off procedures post-treatment
- Conducting cost-benefit analysis for control investments using annualised loss expectancy and return on security investment concepts
- Escalation procedures for accepted risks: conditions, documentation standards, and mandatory periodic review triggers
Module 9: Third-Party and Supply Chain Risk Management
- Identifying IT risk exposure through vendors, cloud providers, and outsourced services
- Conducting third-party risk assessments: questionnaires, audits, and contractual controls
- Vendor risk tiering and ongoing monitoring frameworks
- Managing concentration risk and exit strategies in the supplier portfolio
- Assessing fourth-party risk: understanding how your vendors' own supply chain dependencies extend your organisation's exposure
- Embedding security and risk requirements into the full vendor lifecycle from procurement RFP through contract renewal and offboarding
Module 10: Risk Monitoring, Reporting, and Continuous Improvement
- Building and maintaining a dynamic IT risk register for continuous oversight
- Key Risk Indicators (KRIs) and metrics for ongoing risk monitoring
- Crafting executive risk reports that communicate findings, trends, and recommended actions
- Embedding risk assessment into change management, project delivery, and the security improvement cycle
- Conducting structured post-incident reviews to extract risk register updates and lessons that strengthen future assessments
- Using maturity models and benchmarking to measure programme effectiveness and build a roadmap for continuous improvement
Requirements & Prerequisites
Participants should have a foundational understanding of IT systems, networks, and information security concepts. Experience working in an IT, security, compliance, or technology management role is recommended, as exercises are grounded in real organisational contexts. No prior formal certification in risk management is required, though familiarity with basic security terminology will help delegates engage fully from the first day.
Training Methodology
- Structured threat modelling workshops in which participants map realistic attack surfaces for representative enterprise environments
- Quantitative and qualitative risk scoring exercises using ISO 27005 and NIST SP 800-30 worksheets applied to live case scenarios
- Group-based risk register construction, where teams build, populate, and peer-review a complete risk register from scratch
- Industry case study analysis examining documented IT risk failures — including cloud misconfigurations, ransomware incidents, and third-party breaches — to extract lessons and alternative treatment options
- Control mapping sessions linking identified risks to specific security controls from ISO 27001 Annex A, NIST CSF, and CIS Controls
- Risk communication role plays in which participants present risk findings to a simulated executive board and field challenging questions
- Hands-on use of risk assessment templates, heat maps, risk appetite statements, and reporting dashboards that participants take away for immediate use
- Reflective scenario planning exercises requiring teams to design mitigation roadmaps under constrained budgets and competing business priorities
Organisational Benefits
- Reduced organisational exposure to cyber incidents, data breaches, and technology failures through proactive risk identification
- Improved alignment between IT security investments and actual risk priorities, maximising the return on security spend
- Stronger audit and regulatory compliance posture across frameworks such as ISO 27001, GDPR, PCI-DSS, and sector-specific regulations
- A more risk-aware IT culture where teams identify and escalate emerging threats before they materialise into incidents
- Consistent, repeatable risk assessment processes that reduce reliance on individual expertise and support institutional knowledge
- Better-informed executive decision-making supported by clear, quantified risk reporting and risk appetite articulation
- Enhanced vendor and third-party risk management, reducing supply chain vulnerabilities
- A workforce capable of integrating risk controls into project delivery, change management, and operational processes from the outset
Where Is IT Risk Assessment and Mitigation Strategies Training Offered?
This course runs in-person across: Lagos, Mombasa, Dar es Salaam, Dubai, Nairobi, Abuja, Kigali, Nakuru, Riyadh, Addis Ababa, Cape Town, Zanzibar, Arusha, Johannesburg, Kisumu, Kampala, Accra, Pretoria, Naivasha, plus Live Virtual (online) cohorts. Browse live dates for your city below.
Upcoming Schedules
| Location | Format | Dates | Price |
|---|
| Lagos, Nigeria |
In-Person |
5 Oct 2026 – 9 Oct 2026 |
USD 2,500 |
| Mombasa, Kenya |
In-Person |
5 Oct 2026 – 9 Oct 2026 |
KES 115,000 |
| Dar es Salaam, Tanzania |
In-Person |
12 Oct 2026 – 16 Oct 2026 |
USD 2,300 |
| Live Virtual |
Online |
17 Oct 2026 – 8 Nov 2026 |
KES 80,000 |
| Dubai, United Arab Emirates |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 4,100 |
| Nairobi, Kenya |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
KES 115,000 |
| Abuja, Nigeria |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,800 |
| Kigali, Rwanda |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 1,900 |
| Nakuru, Kenya |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
KES 115,000 |
| Riyadh, Saudi Arabia |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 4,500 |
| Addis Ababa, Ethiopia |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,400 |
| Cape Town, South Africa |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 3,800 |
| Zanzibar, Tanzania |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,500 |
| Arusha, Tanzania |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 2,100 |
| Johannesburg, South Africa |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 3,500 |
+237 more dates — view live schedule →
Frequently Asked Questions
Do I need a security certification to attend this course?
No formal certification is required. The course is designed for professionals with practical IT, security, or compliance experience. A basic understanding of IT systems and security concepts is sufficient to engage fully with the programme content.
Which risk frameworks does the course cover?
The course covers ISO/IEC 27005, NIST SP 800-30, COBIT 2019, and the FAIR model, giving participants a comparative understanding of each and practical experience applying them. Control mapping exercises also reference ISO 27001 Annex A, NIST CSF, and CIS Controls.
Will I receive a certificate upon completing the course?
Yes. Participants who attend and complete the full five-day programme will receive a TrainingComplex Certificate of Completion in IT Risk Assessment and Mitigation Strategies, which can be used for continuing professional development (CPD) records.
Is the course available online as well as in person?
Yes. TrainingComplex offers this programme both as an in-person workshop at scheduled locations across Africa and the Middle East, and as a live virtual course delivered over the same five-day structure with interactive online sessions, breakout rooms, and digital workshop materials.
What materials will participants receive?
All participants receive a comprehensive course workbook, risk assessment templates (risk register, heat map, risk treatment plan, and KRI dashboard), framework reference cards, and digital copies of all case studies and exercises — fully ready to adapt and deploy in their own organisations.
