Cyber Crime - NIS 2 Directive Trained Professional Program

Curriculum

The course has been designed to provide with the skills needed to understand and support compliance with the NIS 2 Directive.

It also provides with the skills needed to pass the NIS 2 Directive Trained Professional (NIS2DTP) exam, and to receive the Certificate of Completion, that provides independent evidence to firms and organizations that you have a quantifiable understanding of the subject matter.

Taking into account the "state-of-the-art" and, where applicable, relevant European and international standards, as well as the cost of implementation, the measures learnt shall ensure a level of security of network and information systems appropriate to the risks posed. When assessing the proportionality of those measures, due account shall be taken of the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.

The measures shall be based on an "all-hazards approach" that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include "at least" the following:

• Policies on risk analysis and information system security;

• Incident handling;

• Business continuity, such as backup management and disaster recovery, and crisis management;

• Supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;

• Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;

• Policies and procedures to assess the effectiveness of cybersecurity risk-management measures;

• Basic cyber hygiene practices and cybersecurity training;

• Policies and procedures regarding the use of cryptography and, where appropriate, encryption;

• Human resources security, access control policies and asset management;

• The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.