About This Course
In an era of escalating cyber threats, ransomware attacks, data breaches, and regulatory scrutiny, organisations can no longer treat cybersecurity as a purely technical concern. IT risk management has become a boardroom priority, requiring professionals who can translate technical vulnerabilities into business risk language and implement structured frameworks that protect information assets, ensure compliance, and enable operational resilience.
This five-day course, IT Risk Management and Cybersecurity Frameworks, provides a rigorous, practice-oriented grounding in the principles, tools, and methodologies that underpin effective cyber-risk governance. Participants will examine leading international frameworks — including NIST Cybersecurity Framework (CSF 2.0), ISO/IEC 27001:2022, COBIT 2019, and the CIS Critical Security Controls — and learn how to apply them within the context of their own organisations.
Beyond frameworks, the course addresses the full IT risk lifecycle: from threat identification and risk quantification to control design, incident response planning, and ongoing monitoring. Participants will engage with realistic case studies drawn from African and global contexts, conduct hands-on risk assessments, and develop practical artefacts — risk registers, control matrices, and cyber-risk reports — that they can deploy immediately upon returning to their roles.
Whether you are an IT manager seeking formal risk methodology, a compliance officer navigating cybersecurity regulations, or a senior leader wanting to strengthen organisational cyber resilience, this programme delivers the frameworks, language, and confidence to drive meaningful security improvements across your enterprise.
Who Should Attend
- IT Managers and IT Directors responsible for security strategy and governance
- Cybersecurity Analysts and Security Operations staff seeking a risk management foundation
- Risk and Compliance Officers overseeing information security obligations
- Chief Information Officers (CIOs) and Chief Information Security Officers (CISOs)
- Internal Auditors reviewing IT controls and cybersecurity posture
- Governance, Risk, and Compliance (GRC) Practitioners
- Systems and Network Administrators transitioning into risk or security roles
- Business Continuity and Disaster Recovery Professionals
- Consultants advising organisations on IT risk and cybersecurity strategy
Learning Objectives
- Explain the core principles of IT risk management and their relationship to enterprise risk governance
- Describe and compare leading cybersecurity frameworks including NIST CSF 2.0, ISO/IEC 27001:2022, COBIT 2019, and the CIS Controls
- Conduct a structured IT risk assessment using qualitative and quantitative methodologies
- Identify, classify, and prioritise information assets and their associated threats and vulnerabilities
- Design and evaluate technical and administrative security controls aligned to framework requirements
- Develop and maintain an IT risk register and risk treatment plan
- Interpret cybersecurity metrics and produce risk reports suitable for senior management and boards
- Align cybersecurity programmes with relevant regulatory and legal requirements including GDPR, national data protection laws, and sector-specific standards
- Develop an incident response plan and integrate it within broader organisational resilience strategies
- Apply a continuous monitoring and improvement model to sustain cybersecurity posture over time
Course Modules
Module 1: Foundations of IT Risk Management
- Defining IT risk: concepts, terminology, and the risk management lifecycle
- Relationship between IT risk, enterprise risk, and corporate governance
- Key roles and responsibilities in cyber-risk governance structures
- Common IT risk categories: confidentiality, integrity, availability, and emerging threats
- Risk appetite, risk tolerance, and risk thresholds: setting organisational boundaries for IT risk acceptance
- Introduction to risk management standards and frameworks as enablers of structured decision-making
Module 2: Introduction to Cybersecurity Frameworks
- Overview of the global cybersecurity framework landscape and its evolution
- NIST Cybersecurity Framework 2.0: structure, core functions, tiers, and profiles
- ISO/IEC 27001:2022: scope, Annex A controls, and certification process
- COBIT 2019 and CIS Critical Security Controls: principles and use cases
- Selecting and tailoring a framework to organisational size, sector, and risk maturity
- Integrating multiple frameworks to avoid duplication and achieve coherent security governance
Module 3: Information Asset Identification and Classification
- Asset inventory methodologies and information classification schemes
- Identifying crown-jewel assets and data flows across the organisation
- Third-party and cloud asset considerations in modern IT environments
- Linking asset classification to risk appetite and control prioritisation
- Data lifecycle management: classifying assets from creation and storage through to secure disposal
- Maintaining asset register accuracy through change management and periodic revalidation processes
Module 4: Threat Intelligence and Vulnerability Assessment
- Threat landscape analysis: threat actors, motives, and attack vectors
- Vulnerability assessment techniques: scanning, penetration testing concepts, and CVE interpretation
- Using threat intelligence feeds and sector-specific advisories
- Mapping threats and vulnerabilities to organisational assets
- Risk-based vulnerability prioritisation using CVSS scores, exploitability evidence, and asset criticality
- Emerging threat categories: supply chain attacks, AI-assisted threats, and zero-day exploitation trends
Module 5: IT Risk Assessment Methodologies
- Qualitative risk assessment: likelihood-impact matrices and risk scoring
- Quantitative risk analysis: Annual Loss Expectancy (ALE), FAIR methodology basics
- Conducting a structured risk assessment workshop and documenting findings
- Risk prioritisation and communicating results to technical and non-technical stakeholders
- Selecting the appropriate assessment methodology based on data availability, asset criticality, and organisational context
- Common pitfalls in risk assessment: cognitive bias, scope creep, and maintaining assessment consistency over time
Module 6: Security Control Design and Selection
- Control types: preventive, detective, corrective, and compensating controls
- Mapping controls to NIST CSF functions and ISO 27001 Annex A domains
- Cost-benefit analysis for control investment decisions
- Control gaps analysis and remediation roadmap development
- Applying defence-in-depth principles to layer controls across people, process, and technology dimensions
- Control testing and validation: assurance techniques for confirming that selected controls operate as intended
Module 7: IT Risk Register and Risk Treatment Planning
- Structuring and maintaining a comprehensive IT risk register
- Risk treatment options: accept, avoid, mitigate, and transfer
- Developing risk treatment plans with owners, timelines, and success criteria
- Integrating the risk register into organisational governance and reporting cycles
- Escalation criteria and trigger-based review processes for managing changes in risk ratings over time
- Using risk register data to support resource allocation decisions and demonstrate return on security investment
Module 8: Regulatory Compliance and Legal Obligations
- Key cybersecurity regulations: GDPR, national data protection acts, and sector-specific requirements in Africa and beyond
- Mapping compliance obligations to framework controls and existing security programmes
- Evidence collection and documentation for audit readiness
- Managing third-party compliance risk in supply chains and outsourcing arrangements
- Understanding breach notification obligations: timelines, responsible parties, and communication requirements under major regimes
- Monitoring the evolving regulatory landscape and building an organisational process for tracking and responding to new legal obligations
Module 9: Incident Response and Cyber Resilience
- Incident response lifecycle: preparation, detection, containment, eradication, and recovery
- Developing and testing an organisational incident response plan
- Integrating incident response with business continuity and disaster recovery planning
- Post-incident review processes and embedding lessons learned into risk management
- Roles and responsibilities within an incident response team: establishing a CSIRT and defining escalation paths
- Crisis communications during a cyber incident: managing internal stakeholders, regulators, customers, and the media
Module 10: Cyber-Risk Reporting, Monitoring, and Continuous Improvement
- Designing meaningful cybersecurity Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs)
- Producing board-level cyber-risk dashboards and executive reports
- Continuous monitoring tools and techniques: SIEM concepts, vulnerability management cycles
- Building a culture of continuous improvement and cyber-risk maturity progression
- Conducting periodic cyber-risk maturity assessments and benchmarking performance against industry peers and framework targets
- Linking monitoring outcomes to the risk treatment planning cycle to ensure that new findings drive timely updates to controls and risk registers
Requirements & Prerequisites
Participants should have at least two years of experience in an IT, information security, audit, or risk-related role. A basic familiarity with networking concepts, information systems, or IT operations is recommended. No prior formal cybersecurity certification is required, though candidates with foundational knowledge such as CompTIA Security+ or equivalent experience will benefit most from the advanced modules.
Training Methodology
- Framework mapping workshops where participants compare NIST CSF, ISO 27001, COBIT, and CIS Controls side by side using structured comparison matrices
- Hands-on IT risk assessment exercises using real-world scenario data to build qualitative and quantitative risk registers
- Case study analysis of high-profile cyber incidents — including ransomware attacks, data breaches, and supply chain compromises — to extract governance lessons
- Small-group control design sessions where teams select and justify security controls mapped to identified risks
- Cyber-risk reporting role plays in which participants present risk findings to a simulated board or executive committee
- Incident response tabletop simulation requiring participants to work through a realistic breach scenario and activate a response plan
- Peer review sessions where participants critique each other's risk treatment plans and control matrices using provided rubrics
- Policy and procedure drafting exercises producing artefacts participants can adapt directly for their organisations
- Reflective journalling prompts at the end of each day to consolidate learning and identify personal application priorities
Organisational Benefits
- Organisations gain staff who can lead structured IT risk assessments and produce actionable risk registers
- Improved alignment between cybersecurity investments and genuine business risk priorities
- Stronger compliance posture against international standards and local regulatory requirements
- Reduced likelihood and impact of cyber incidents through improved control design and governance
- Enhanced board-level reporting on cyber risk through clearer metrics and risk communication skills
- Capacity to implement and sustain recognised cybersecurity frameworks without dependence on external consultants
- Better integration of cybersecurity into business continuity, procurement, and project management processes
- A shared risk language across IT and non-IT leadership, improving collaboration and decision-making
- Greater organisational confidence during external audits, certification assessments, and regulatory reviews
Where Is IT Risk Management and Cybersecurity Frameworks Training Offered?
This course runs in-person across: Mombasa, Abuja, Dar es Salaam, Riyadh, Kigali, Accra, Johannesburg, Lagos, Addis Ababa, Naivasha, Nakuru, Kampala, Zanzibar, Nairobi, Kisumu, Pretoria, Cape Town, Dubai, Arusha, plus Live Virtual (online) cohorts. Browse live dates for your city below.
Upcoming Schedules
| Location | Format | Dates | Price |
|---|
| Mombasa, Kenya |
In-Person |
5 Oct 2026 – 9 Oct 2026 |
KES 115,000 |
| Abuja, Nigeria |
In-Person |
5 Oct 2026 – 9 Oct 2026 |
USD 2,800 |
| Dar es Salaam, Tanzania |
In-Person |
12 Oct 2026 – 16 Oct 2026 |
USD 2,300 |
| Riyadh, Saudi Arabia |
In-Person |
12 Oct 2026 – 16 Oct 2026 |
USD 4,500 |
| Kigali, Rwanda |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 1,900 |
| Accra, Ghana |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 3,800 |
| Johannesburg, South Africa |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 3,500 |
| Lagos, Nigeria |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,500 |
| Addis Ababa, Ethiopia |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,400 |
| Naivasha, Kenya |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
KES 120,000 |
| Nakuru, Kenya |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
KES 115,000 |
| Kampala, Uganda |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 1,900 |
| Live Virtual |
Online |
24 Oct 2026 – 15 Nov 2026 |
KES 80,000 |
| Live Virtual |
Online |
26 Oct 2026 – 30 Oct 2026 |
KES 80,000 |
| Zanzibar, Tanzania |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 2,500 |
+237 more dates — view live schedule →
Frequently Asked Questions
Do I need a cybersecurity certification to attend this course?
No formal certification is required. The course is designed for professionals with practical IT, audit, or risk experience. Candidates with foundational certifications such as CompTIA Security+ will find the content builds well on that knowledge, but it is not a prerequisite.
Will participants receive a certificate upon completion?
Yes. Delegates who attend the full programme and complete the required exercises will receive a Certificate of Completion in IT Risk Management and Cybersecurity Frameworks issued by TrainingComplex. This certificate can support continuing professional development (CPD) requirements for bodies such as ISACA, IIA, and ISC2.
Is this course applicable outside the technology sector?
Absolutely. While the content is technically grounded, it is designed for professionals across all sectors including financial services, healthcare, government, NGOs, and manufacturing. Cybersecurity risk affects every organisation that relies on digital systems, and the frameworks covered are sector-agnostic.
What materials and tools will participants receive?
Participants receive a comprehensive course workbook, framework comparison matrices, risk assessment templates, a risk register template, control mapping worksheets, and an incident response plan template — all formatted for immediate workplace use.
Can organisations send multiple staff members at a discounted group rate?
Yes. TrainingComplex offers group enrolment discounts for three or more delegates from the same organisation. Please contact our training coordinators directly to discuss group pricing, in-house delivery options, and customisation of the programme to your organisation's specific frameworks and risk environment.
