Objective

To enable students to develop a deep understanding of globally recognized cybersecurity
compliance frameworks and to apply them in real-world organizational environments.

This phase focuses on:

• Understanding the structure and purpose of major compliance standards
• Implementing security controls aligned with regulatory and industry requirements
• Performing audits and compliance assessments
• Developing documentation required for certification and regulatory adherence

Students will be trained to think and operate as GRC professionals, capable of bridging
the gap between technical security and organizational governance.

Module 1: ISO 27001 (Weeks 13–14)

1. Introduction to ISMS

• Definition and purpose of an Information Security Management System
• Importance of ISO 27001 in global organizations
• Risk-based approach to information security

2. ISO 27001 Structure (Clauses 4–10)

• Context of the organization
• Leadership and governance responsibilities
• Planning and risk management
• Support and resource allocation
• Operational controls
• Performance evaluation
• Continuous improvement

3. Annex A Control Domains

• Access control
• Asset management
• Cryptography
• Operations security
• Incident management
• Supplier relationships

4. Documentation Requirements

• Policies, procedures, and standards
• ISMS scope definition
• Statement of Applicability (SoA)

Practical Implementation

Students will simulate ISO 27001 implementation for a sample organization:

• Define ISMS scope based on business requirements
• Create asset inventory and classification
• Perform risk assessment and develop a risk register
• Draft key security policies (Access Control, Password, Incident Response)

Deliverables

• ISMS Documentation Package
• Risk Register
• Statement of Applicability (SoA)
• Security Policy Set

Module 2: SOC 2 (Weeks 15–16)

1. SOC 2 Overview

• Purpose and applicability of SOC 2
• Differences between Type 1 and Type 2 reports
• Role of auditors and service organizations

2. Trust Services Criteria

• Security
• Availability
• Confidentiality
• Processing Integrity
• Privacy

3. Control Design and Implementation

• Logical access controls
• Change management processes
• Monitoring and logging mechanisms
• Incident detection and response

4. Continuous Monitoring and Evidence

• Importance of ongoing control validation
• Documentation and audit readiness

Practical Implementation

Students will conduct a simulated SOC 2 audit for a SaaS company:

• Map controls against Trust Services Criteria
• Evaluate effectiveness of implemented controls
• Identify missing or weak controls
• Validate documentation and system configurations

Deliverables

• SOC 2 Control Checklist
• Control Mapping Document
• Gap Analysis Report
• Audit Observation Summary

Module 3: PCI DSS (Weeks 17–18)

1. PCI DSS Overview

• Purpose and scope of PCI DSS
• Cardholder Data Environment (CDE)
• Merchant levels and compliance requirements

2. The 12 PCI DSS Requirements

Grouped into key domains:

• Build and maintain secure networks
• Protect cardholder data
• Maintain vulnerability management programs
• Implement strong access control measures
• Monitor and test networks
• Maintain information security policies

3. Data Protection and Encryption

• Encryption of cardholder data
• Secure storage and transmission
• Tokenization and masking

4. Logging, Monitoring, and Testing

• Log management
• Security monitoring
• Vulnerability scanning and penetration testing

Practical Implementation

Students will perform a simulated audit of an e-commerce environment:

• Identify scope of cardholder data
• Evaluate storage and transmission practices
• Assess logging and monitoring mechanisms
• Identify non-compliance areas

Deliverables

• PCI DSS Audit Checklist
• Cardholder Data Flow Diagram
• Risk Findings Report
• Compliance Gap Analysis

Module 4: HIPAA (Weeks 19–20)

1. Introduction to HIPAA

• Overview of HIPAA and its importance
• Covered entities and business associates
• Definition of Protected Health Information (PHI)

2. HIPAA Rules

• Privacy Rule
• Security Rule
• Breach Notification Rule

3. Safeguards

• Administrative safeguards (policies, training)
• Technical safeguards (encryption, access control)
• Physical safeguards (facility security, device control)

4. Compliance and Enforcement

• Audit requirements
• Penalties for non-compliance
• Incident response and breach handling

Practical Implementation

Students will perform a simulated audit of a healthcare system:

• Identify PHI handling processes
• Evaluate access control mechanisms
• Assess encryption and data protection practices
• Identify compliance gaps

Deliverables

• HIPAA Compliance Checklist
• PHI Data Flow Analysis
• Audit Findings Report
• Remediation Recommendations