ITI42122 Cyber Security Governance (Autumn 2025)

• NIST Cybersecurity Framework (CSF
• Control Objectives for Information and Related Technology (COBIT)
• Information Technology Infrastructure Library (ITIL) for security management
• ISO/IEC 27001 Information Security Management Systems

Knowledge

The student

• knows main ISO IT Security standards
• is familiar with the Information Technology Infrastructure Library (ITIL)
• knows how to apply Control Objectives for Information and Related Technology (COBIT) to specific information security topics/practices within an enterprise.
• is familiar with the NIST Cybersecurity Framework (CSF)
• is able to understand main risk scenarios and challenges
• is able to identify and understand security and controls across the strategic, tactical, and operational levels within an organization
• is able to distinguish governance and management by their types of activities and responsibilities

Skills

The student is able to

• use well-known frameworks and standards (NIST, COBIT, ITIL, ISO 27K) in real settings
• justify the need of IT Security and continuity planning issues for effective IT and guide them in practical business settings
• select the appropriate controls
• know whether business operations and information are secure and reliable
• know whether an enterprise is maintaining an effective system of internal control
• assess and articulate security risks from the board level to the code level.

General competence

The student gains experience with project work, including planning, performing and reporting in an existing research area.

The student must deliver:

• up to two assignments.
• complete and present a preliminary security governance plan on a selected case study. The case study is chosen by the students and agreed with the course responsible. The plan can be developed individually or in groups of two students. All group members must contribute to the plan.

Coursework requirements must be accepted to qualify for the exam.

The exam is divided into two parts:

• An individual oral presentation of the final security governance plan based on the group case study (50%). Duration approx. 5-10 min. Except the presentation, no supporting materials are allowed.
• An individual oral exam (50%) based on the course curriculum. Duration approx. 10-20 min. No supporting materials are allowed.

Grading scale A - F in both parts. Both parts of the exam must be passed to pass the course. The student will get an individual joint grade for the entire course.

Resit / rescheduled exam is carried out at the same time as the next ordinary examination. The department management can nevertheless decide to arrange a resit exam in the following semester for students with a valid absence at the ordinary exam.

Upon re-examination, each part of the examination must be retaken.

This course is evaluated by a:

• Final course evaluation (compulsory)

The responsible for the course compiles a report based on the feedback from the students and his/her own experience with the course. The report is discussed by the study quality committee at the Department of Computer Science and Communication.