ITI42122 Cyber Security Governance (Autumn 2026)

Recommended pre-knowledge:

• at least 80 ECTS credits in computer science, of which at least 20 ECTS credits in programming.
• basic understanding of information security principles, security challenges and potential risks, be familiar with IT infrastructure and enterprise processes.

• NIST Cybersecurity Framework (CSF
• Control Objectives for Information and Related Technology (COBIT)
• Information Technology Infrastructure Library (ITIL) for security management
• ISO/IEC 27001 Information Security Management Systems

Knowledge

The student

• knows the main ISO IT Security standards
• is familiar with the Information Technology Infrastructure Library (ITIL)
• knows how to apply Control Objectives for Information and Related Technology (COBIT) to specific information security topics/practices within an enterprise.
• is familiar with the NIST Cybersecurity Framework (CSF)
• is able to understand the main cybersecurity governance challenges
• is able to distinguish governance from management based on their activities and responsibilities
• is able to identify and understand cybersecurity governance and controls across different levels within an organization

Skills

The student is able to

• use well-known frameworks and standards (NIST, COBIT, ITIL, ISO 27K) in real settings
• justify the need of IT Security and continuity planning issues for effective cybersecurity governance and guide them in practical business settings
• select the appropriate controls and metrics
• know whether business operations and information are secure and reliable
• know whether an enterprise is maintaining an effective system of internal control
• articulate cybersecurity governance at various levels within an organization

General competence

The student will understand the principles and role of cybersecurity governance and gain practical knowledge and experience in planning and implementation within organizational contexts.

The student must deliver:

• up to two assignments.
• complete and present a preliminary security governance plan on a selected case study. The case study is chosen by the students and agreed with the course responsible. The plan will be developed in groups of two-three students. All group members must contribute to the plan.

Coursework requirements must be accepted to qualify for the exam.

The exam is divided into two parts:

• A final security governance plan based on the group case study (50%). Students will receive individual grades based on their documented contributions.
• An individual oral exam (50%) based on the course curriculum. Duration approx. 10-20 min. No supporting materials are allowed.

Grading scale A - F in both parts. Both parts of the exam must be passed to pass the course. The student will get an individual joint grade for the entire course.

Resit / rescheduled exam is carried out at the same time as the next ordinary examination. The department management can nevertheless decide to arrange a resit exam in the following semester.

Upon re-examination, each part of the examination must be retaken.

This course is evaluated by a:

• Final course evaluation

The responsible for the course compiles a report based on the feedback from the students and his/her own experience with the course. The report is discussed by the study quality committee at the Department of Computer Science and Communication.