ForensicSpot10 modules
Information Security Audit and Compliance
Auditing and governing information security: risk assessment, control frameworks, ISO 27001, the audit process, compliance regimes, and remediation.
- 60hours
- 30topics
- 10modules
Module 16 hrs3 topics
Foundations of Information Security
The CIA triad, threats, and the language of security governance.
Start module- The CIA Triad and Security FundamentalsIntroduces confidentiality, integrity, and availability as the three pillars of information security, and the vocabulary used across governance and audit work.13 min
- The Threat Landscape and Threat ActorsSurveys threat categories from nation-state attackers and organised crime to insider risk and accidental disclosure, and how intelligence shapes audit scope.13 min
- Security Governance Frameworks OverviewExplains governance's role in information security, including accountability structures and the policy hierarchy linking boards, executives, and security teams.13 min
Module 26 hrs3 topics
Risk Management and Assessment
Identifying, assessing and treating information-security risk.
Start module- Risk Identification and Asset ClassificationCovers cataloguing information assets, classifying them by sensitivity and criticality, and identifying threats and vulnerabilities per asset.13 min
- Risk Assessment MethodologiesCompares qualitative and quantitative risk assessment, including likelihood-impact matrices, FAIR, and annualised loss expectancy calculations.13 min
- Risk Treatment and the Risk RegisterDescribes the four risk treatment options (accept, avoid, mitigate, transfer) and how decisions are logged in a risk register.13 min
Module 36 hrs3 topics
Security Controls and Frameworks
NIST CSF, CIS Controls and how control catalogues are used.
Start module- The NIST Cybersecurity FrameworkExplains the NIST CSF's five core functions (Identify, Protect, Detect, Respond, Recover) and the shift from CSF 1.1 to 2.0 with its new Govern function.13 min
- CIS Controls and Implementation GroupsSurveys the CIS Critical Security Controls, their Implementation Groups (IG1-IG3), and the CIS Benchmarks auditors use as a measurement baseline.13 min
- Mapping Controls Across FrameworksShows how NIST SP 800-53, ISO 27002, CIS Controls, and PCI-DSS overlap, and how cross-mapping reduces duplication across multiple compliance regimes.13 min
Module 46 hrs3 topics
ISO/IEC 27001 and the ISMS
The information security management system and certification.
Start module- ISO/IEC 27001: Standard Structure and RequirementsExplains the ISO/IEC 27001:2022 clause structure, from organisational context through risk treatment and continual improvement, versus ISO 27002 guidance.13 min
- Designing and Implementing an ISMSCovers establishing an ISMS: defining scope, applying Annex A controls, producing the Statement of Applicability, and common implementation pitfalls.13 min
- ISO/IEC 27001 Certification and Surveillance AuditsDescribes the ISO/IEC 27001 three-year certification cycle (Stage 1, Stage 2, annual surveillance audits) and how nonconformities are classified.13 min
Module 56 hrs3 topics
The Security Audit Process
Planning, fieldwork, testing and evidence in a security audit.
Start module- Audit Planning and Scope DefinitionCovers pre-engagement audit activities: defining objectives and scope, understanding the environment, identifying controls to test, and building the audit plan.13 min
- Fieldwork, Evidence Collection, and Control TestingExamines audit fieldwork, including interviews, document review, and configuration inspection, and the standards for evidence sufficiency and control testing.13 min
- Audit Sampling Techniques and Working PapersIntroduces statistical and judgement-based sampling for security audits, and the structure and retention of working papers behind audit opinions.13 min
Module 66 hrs3 topics
Compliance Regimes
GDPR, the Digital Personal Data Protection Act 2023, HIPAA and PCI-DSS.
Start module- GDPR: Core Principles and Audit ObligationsExplains GDPR's seven data-protection principles, its accountability requirement, lawful bases for processing, and enforcement consequences auditors examine.13 min
- India's Digital Personal Data Protection Act 2023Surveys India's DPDP Act 2023, covering data principal rights, fiduciary obligations, Significant Data Fiduciary status, and the Data Protection Board.13 min
- HIPAA and PCI-DSS Compliance RequirementsCovers HIPAA's administrative, physical, and technical safeguards for health information, and the twelve PCI-DSS requirements for payment card data.13 min
Module 76 hrs3 topics
Governance, Policy and Assurance Reports
Policy, governance structures and SOC 2 / assurance reporting.
Start module- Information Security Policy HierarchyDescribes the three-tier policy architecture of standards, policies, and procedures, and how audits verify they stay current and enforced.13 min
- Security Governance Structures and RolesExamines governance structures including boards, audit committees, and CISOs, and the three-lines-of-defence model for security oversight.13 min
- SOC Reports and Third-Party AssuranceExplains the AICPA SOC framework: SOC 1 financial-reporting controls versus SOC 2 trust criteria and SOC 3, plus Type I versus Type II reports.13 min
Module 86 hrs3 topics
Technical Assessment Interface
How vulnerability assessment and testing feed the audit.
Start module- Vulnerability Assessment as Audit EvidenceExplains how vulnerability scan output feeds security audits as evidence of control effectiveness, covering CVSS scoring and remediation priority.13 min
- Penetration Testing Scope and Audit InterfaceDescribes how penetration testing engagements interface with the audit function, covering commissioning, scope, and interpreting the test report.13 min
- Security Metrics and Continuous MonitoringCovers designing KRIs and KPIs for security controls, and how continuous monitoring gives assurance between point-in-time audits.13 min
Module 96 hrs3 topics
Third-Party and Supply-Chain Risk
Assessing vendors and managing supply-chain exposure.
Start module- Third-Party Risk Management ProgrammeExplains the third-party risk lifecycle from due diligence and onboarding through reassessment and offboarding, and vendor tiering by criticality.13 min
- Vendor Security Questionnaires and AssessmentsSurveys vendor assessment instruments such as SIG and CAIQ questionnaires and on-site assessments, and how findings are validated and escalated.13 min
- Supply-Chain Risk and Software DependenciesAddresses software supply-chain risk, including open-source dependencies and SBOMs, and the audit controls that detect compromised components.13 min
Module 106 hrs3 topics
Reporting, Remediation and Improvement
Findings, remediation tracking and continuous improvement.
Start module- Audit Report Structure and Communicating FindingsDescribes a security audit report's structure, from executive summary through findings and risk ratings, and how to communicate them clearly.13 min
- Remediation Tracking and Management Action PlansCovers the post-audit remediation cycle: management action plans, owners and deadlines, closure evidence, and escalating recurring findings.13 min
- Continuous Improvement and Audit Programme MaturityExplains how audit programmes mature through lessons-learned reviews, models like CMMC tiers, and integration with enterprise risk management.13 min