Designed for senior managers, directors, business owners, department heads, and leaders working across risk, governance and operations.

The programme is aimed at people who need to make, influence or oversee cyber risk decisions rather than technical cyber security specialists. It is particularly useful for leaders responsible for business continuity, supplier relationships, investment priorities, governance or incident escalation.

No programming or specialist cyber security knowledge is required. Basic digital literacy is sufficient.

This programme will help you if you want to:

• Understand cyber risk in business and operational terms
• Identify the services, systems, people and suppliers your organisation depends on
• Assess and prioritise cyber risks against organisational risk appetite
• Make more informed decisions about controls and cyber investment
• Strengthen governance, escalation and board oversight
• Prepare for incident response and business continuity decisions
• Challenge supplier assurance and understand concentration risk
• Create a practical, measurable resilience improvement plan

Cyber resilience is about keeping critical services running, making sound decisions during disruption and recovering safely. This programme moves beyond awareness training to focus on the decisions leaders are responsible for before, during and after a cyber incident.

Across two days, you will connect cyber threats to operational, financial and reputational consequences, practise prioritising risk and investment, and test your response through a realistic incident simulation.

Understand cyber threats and business impact

Explore ransomware, phishing, business email compromise, insider risk and supplier incidents. Consider confidentiality, integrity and availability, and how a technical incident can quickly become an operational and reputational crisis.

Map what your organisation depends on

Identify critical services and the information, systems, people and suppliers that support them. You will use business impact thinking to consider disruption tolerance, dependencies and potential single points of failure.

Assess and prioritise cyber risk

Work with threats, vulnerabilities, likelihood and impact, inherent and residual risk, risk appetite and treatment options. You will build a practical risk register that links existing controls, evidence, ownership and priority actions.

Choose proportionate controls and investment

Review common controls such as identity and access management, multi factor authentication, patching, backups, monitoring and staff awareness. The emphasis is on linking controls to the risks they address and evaluating whether there is evidence that they work.

Strengthen governance and board oversight

Consider leadership accountability, risk acceptance, escalation and reporting. The programme introduces the UK Cyber Governance Code of Practice and NIST Cybersecurity Framework 2.0 as useful structures for leadership oversight and improvement.

Lead incident response and recovery

Practise activation thresholds, incident roles, decision authority, escalation, stakeholder communications and the first 60 minutes of an incident. You will also explore recovery objectives, workarounds, restoration priorities, backup testing and safe return to service.

Test your response through a tabletop exercise

A fictional ransomware and supplier outage scenario develops through timed updates. Teams make decisions on service priorities, escalation and communications, record their reasoning and test assumptions about response and recovery.

Turn learning into a 90 day plan

Following the exercise, you will examine supplier assurance, contractual incident support, concentration risk, exit options and the limits of cyber insurance. You will then build an improvement plan with owners, budget estimates, milestones and measurable outcomes.

The programme is built around practical outputs that can support real conversations about cyber risk, resilience and investment back in your organisation.

You will leave with:

• A critical service dependency map and prioritised cyber risk register
• A board risk summary and prioritised control improvements
• A first 60 minutes incident action checklist
• A service recovery outline with recovery objectives
• A tabletop exercise decision log and lessons identified
• A 90 day resilience improvement plan with owners and measures

By the end of the programme, you should be able to:

• Explain cyber resilience and the business consequences of cyber incidents
• Identify critical services, assets and dependencies and assess their cyber risks
• Prioritise proportionate controls and investment against organisational risk appetite
• Define governance responsibilities, supplier assurance and escalation arrangements
• Apply incident response and business continuity principles in a leadership simulation
• Produce a 90 day improvement plan with owners, milestones and measurable outcomes

Course duration

Two days, 09:00 to 17:00 each day.

The programme provides 13 guided learning hours, excluding lunch and refreshment breaks.

Participants

Suggested cohort size: 15 to 25 participants.

The group format supports discussion, workshops, challenge and a realistic incident tabletop exercise.

How the programme is delivered

Learning is practical and discussion led, using fictional case materials so participants can explore decisions safely without needing to share sensitive organisational information.

• Interactive seminars
• Case studies
• Practical workshops
• Cyber risk and control prioritisation exercises
• Incident tabletop simulation
• Boardroom presentations and peer challenge

Day 1: Understanding cyber risk and building resilience

Day 1 focuses on identifying critical services and dependencies, assessing risk, prioritising controls and strengthening governance.

• Cyber threats and business impact
• Critical service and dependency mapping
• Cyber risk assessment and prioritisation
• Control selection and assurance
• Governance and board oversight

Day 2: Responding, recovering and improving

Day 2 focuses on incident leadership, business continuity, recovery, supplier risk and turning lessons into an improvement plan.

• Incident response and crisis leadership
• Business continuity and recovery
• Cyber incident tabletop exercise
• Supplier risk and investment decisions
• 90 day resilience planning
• Boardroom presentation and challenge

Preparation and equipment

Participants should bring a brief, non sensitive description of one organisational service and its key dependencies. A laptop and internet access are required; worksheets and fictional case materials are supplied.