Information Security Governance

Curriculum

1. 1

   Fundamentals of information security governance: concepts, stakeholders, responsibilities

   Lecture

   3h
2. 2

   ISO 27001: structure, clauses and Annex A

   Lecture + exercises

   4h
3. 3

   Information security policy: drafting and approval

   Hands-on workshop

   3h
4. 4

   Regulatory overview: BCEAO, BEAC, SMCA, DORA, NIS2

   Comparative course

   3h
5. 5

   Cyber awareness and culture: programmes for financial institutions

   Practical case

   3h
6. 6

   Introduction to information security incident management

   ROOM#42 simulation (observation)

   3h
7. 7

   Revision and exam preparation

   Mock multiple-choice test

   2h

Skills acquired

• Explain the principles of information security governance and how they apply in banking
• Navigate the ISO 27001 standard and identify its key requirements
• Draft a basic information security policy
• Understand the BCEAO/BEAC regulatory framework applicable to information security

Curriculum

1. 1

   Deploying an ISO 27001 ISMS in a financial institution: PDCA roadmap

   Project workshop

   6h
2. 2

   Statement of Applicability (SoA) and risk treatment plan

   Practical work

   5h
3. 3

   Information security indicators and dashboards (KPI/KRI) for the executive committee

   Power BI workshop

   4h
4. 4

   Internal information security audit: planning, conduct, report

   Audit simulation

   5h
5. 5

   Incident management: CSIRT, implementation, regulatory escalation

   ROOM#42 simulation

   5h
6. 6

   Awareness and training: designing an annual programme

   Teaching workshop

   4h
7. 7

   Preparing for ISO 27001 certification: working with the auditor

   Role play

   4h
8. 8

   ISMS file presentation and feedback

   Coaching

   2h

Skills acquired

• Deploy an ISO 27001 ISMS following the PDCA cycle in a financial institution
• Produce a Statement of Applicability and an operational risk treatment plan
• Run an internal information security audit in line with ISO 19011
• Lead incident response in line with BCEAO regulatory requirements

Curriculum

1. 1

   Architecture of a pan-African information security programme (multi-entity, multi-regulator)

   Lecture + group case

   6h
2. 2

   Integrating COBIT 2019 and ISO 27001 into banking IT governance

   Advanced course

   5h
3. 3

   Cyber resilience: ISO 22301 + DORA applied to the WAEMU/CEMAC zone

   Strategy workshop

   5h
4. 4

   Information security reporting to the regulator: content, frequency, legal responsibilities

   Regulatory simulation

   4h
5. 5

   Leading an information security crisis exercise (ROOM#42) as coordinator

   ROOM#42 exercise

   6h
6. 6

   Business intelligence and strategic cyber watch for financial institutions

   Expert seminar

   5h
7. 7

   Information security due diligence in mergers, acquisitions and fintech partnerships

   Case study

   4h

Skills acquired

• Design a strategic information security programme for a multi-zone financial group
• Integrate COBIT, ISO 27001, ISO 22301 and DORA into a coherent governance architecture
• Lead a strategic-level information security crisis exercise in ROOM#42
• Represent information security before regulators and governance bodies

Curriculum

1. 1

   Instructional design for information security governance

   Seminar

   4h
2. 2

   Designing ROOM#42 crisis simulations (scenarios, roles, debriefing)

   Hands-on workshop

   6h
3. 3

   Assessing and certifying governance learners

   Course

   3h
4. 4

   Delivering an AFP-Gouv module in real conditions

   Assessed demonstration

   8h

Skills acquired

• Deliver the entire AFP-Gouv track (Foundation to Expert)
• Design immersive crisis scenarios for ROOM#42
• Contribute to the AFP-Gouv framework as standards evolve