Cyber risk governance for boards and executive leaders
A leadership course on governing cyber risk rather than running the operations centre: management-body duties under NIS2, residual risk in business terms, the NIS2 and CRA landscape, post-quantum cryptography as a time-bound strategic risk, and assurance and investment decisions. Five modules, each with a worked example, and a 10-question final quiz. Based on cited official pages and public frameworks. Not an accredited qualification and not legal advice.
What you will learn
- Explain and apply: State what a management body must approve and oversee under NIS2, and why CSF 2.0 treats governance as a function of leadership.
- Explain and apply: Set risk appetite and demand residual-risk reporting in business terms, using questions a board can actually ask.
- Explain and apply: Map the organisation’s exposure to NIS2 and the Cyber Resilience Act at leadership level, without confusing the two regimes.
- Explain and apply: Treat post-quantum cryptography as a present, time-bound strategic risk, based on the published NIST standards and transition guidance.
- Explain and apply: Commission assurance and decide investment or stop-points using digital-security risk-management principles, not tool catalogues.
modules
- Cyber risk is a governance duty
- Appetite, residual risk and questions a board can ask
- The regulatory landscape at leadership level
- Post-quantum cryptography as a strategic risk
- Assurance, investment and knowing when to stop
Leadership education only. It is not legal, insurance or investment advice and not an accredited qualification. Duties depend on scope, national law and any later amendment. Official pages and standards are summarised as read on the access date; check effective dates and local adoption. Figures in worked examples are illustrative.