Course Objectives

• Implement governance, risk management and compliance processes that are effective and efficient.
• Understand, define, and enhance organizational culture as it relates to performance, risk, and compliance

Learning Outcomes

• SNO	DESCRIPTION	PO MAPPING
  CO1	Understand the IT and business strategy alignment.	PO1, PO2, PO5, PO6, PO11, PO12
  CO2	Understand the Facilitates IT strategic planning. Facilitates conversion of strategic goals into IT projects	PO1, PO2, PO4, PO5, PO11
  CO3	Assists in project management.	PO1,PO2, PO5, PO6, PO7

Course Syllabus

MSCS2102-IT GOVERNANCE, RISK AND COMPLIANCE

MODULE (I):                                                                                                           

Governance, Risk & Compliance GRC–Definitions–Governance,Risk,Compliance,Risk Threshold, Risk Modeling, Risk Appetite, GovernanceStandards. Best Practices for IT Governance–ITIL - ISO/IEC 27001 - Control Objectives of Information and Related Technology (COBIT) – TheInformation Security Management Maturity Model - Capability Maturity Model – latest standards andcompliance technologies.

MODULE (II):                                                                                                                     

Information Security Governance -Effective Information Security Governance - Importance ofInformation Security Governance - Outcomes of Information Security Governance - Strategic alignment – RiskManagement - Performance Measurement - Information System Strategy - Strategic Planning - Steering Committee- Policies and Procedures.

MODULE (III):                                                                                                                    

Information Security Management Practices-Personnel Management - Financial Management–Quality Management - Information Security Management - Performance Optimization - Roles and Responsibilities - Auditing IT Governance Structure - Evaluation Criteria & Benchmark  - Assessment Tools -Case Study Analysis - Risk Management framework–COSO - The Internal environment - Objective Setting -Event Identification - Risk assessment - Risk Response - Control activities - Information & communication–Monitoring–NIST - Risk Assessment - Risk Mitigation - Evaluation & Assessment - Case Study Analysis.

MODULE (IV):                                                                                                                    

Compliance–Introduction-Information Technology and security - Evolution of Information systems -Roles and responsibilities - Audit, Assessment and review - The Role of the Compliance Officer - The duties and responsibilities of the compliance officer and the function of compliance - Compliance officer activities - The requirements of a Compliance Officer - Drafting compliance reports – Designing an Internal Compliance System -Regulatory principles–Issues - Developing high-level compliance policies - Defining responsibility for compliance- The compliance function - Specific internal compliance control issues–Information System Audit - Scope ofSystem Audit - Audit Planning - Audit Manual - Audit check lists - Audit Reports - Best Practices for ITcompliance and Regulatory Requirements.

TEXT BOOK:

• Information Security Governance: Guidance for Information Security Managers by W. KragBrotby,1^st Edition, Wiley Publication, 13 April 2009

Information Security Governance: Guidance for Boards of Directors and Executive Management, 2^ndEdition by W. Krag Brot by, 2nd Edition, ISACA Publication, 01 Mar 2006.

Session Plan

Session 1

Governance,Risk,Compliance:

GRC-1

Session 2

Governance, Risk, Compliance-

Governance

Session 3

Risk Threshold, Risk Modeling, Risk Appetite-

Risk Threshold

Session 4

Governance Standards. Best Practices for IT Governance-

Governance Standard1

Session 5

ITIL - ISO/IEC 27001 - Control Objectives of Information and Related Technology

ITIL

Session 6

The Information Security Management Maturity Model-

The Information Security Management Maturity Model

Session 7

Capability Maturity Model – latest standards and compliance technologies-

Capability Maturity Model

Session 8

Information Security Governance, Effective Information Security Governance -

Information Security Governance

Session 9

 Importance of Information Security Governance-

Importance of Information Security Governance

Session 10

 Outcomes of Information Security Governance-

Outcomes of Information Security Governance

Session 11

Strategic alignment – Risk Management

Strategic alignment Information Security Governance

Session 12

Performance Measurement - Information System Strategy-

Performance measurement

Session 13

Strategic Planning - Steering Committee-

Strategic Planning

Session 14

 Steering Committee- Policies and Procedures.

Policies and Procedures in ISG 

Session 15

Personnel Management, Financial management, Quality Management

Personnel Management in ISMP

Session 16

Financial Management–Quality Management

Financial Management in ISMP

Session 17

Information Security Management - Performance Optimization

Information Security Management

Session 18

Auditing IT Governance Structure - Evaluation Criteria & Benchmark-

Auditing IT Governance Structure

Session 19

Assessment Tools -Case Study Analysis-Risk Management Frame work-

Assessment Tools

Session 20

COSO - The Internal environment - Objective Setting -Event Identification

COSO

Session 21

Risk assessment - Risk Response - Control activities - Information & communication

Risk assessment

Session 22

Monitoring–NIST - Risk Assessment

Monitoring

Session 23

Risk Mitigation - Evaluation & Assessment - Case Study Analysis

Risk Mitigation

Risk Mitigation-M3-2

Session 24

Evolution of Information systems -Roles and responsibilities-

Evolution of Information systems

Session 25

The Role of the Compliance Officer - The duties and responsibilities of the compliance officer 

The Role of the Compliance Officer

Session 26

 function of compliance - Compliance officer activities

function of compliance

Session 27

The requirements of a Compliance Officer - Drafting compliance reports

The requirements of a Compliance Officer

Session 28

 Designing an Internal Compliance System -Regulatory principles–Issues

Designing an Internal Compliance System

Session 29

Developing high-level compliance policies - Defining responsibility for compliance

Developing high

Session 30

The compliance function - Specific internal compliance control issues, Information System Audit - Scope of System Audit

The compliance function

Session 31

Audit Planning - Audit Manual - Audit check lists

Audit planning in Information System

Session 32

Audit Reports - Best Practices for IT compliance,

Best Practices for  Regulatory Requirements

Audit Reports