IT Governance is the system by which the current and future use of IT is directed and controlled. IT governance involves evaluating and directing the use of IT to secure information - and the technology that is used to manage it for an organisation or the wider community. It involves engineering basic principles into the socio-technical framework of IT.

This is a course unit developed and delivered by Daniel Dresner, a graduate of Manchester Business School who works with government, industry, and the third sector to secure information systems. Over the period of the module, students are joined by a cohort of guest lecturers from industry.

This course unit covers the coordination of business decision making for the assurance of information. It concentrates how business responsibilities consider security in strategy, acquisition, performance, conformance, and human behaviour.

• Apply analytical techniques to steer a community out of a cyber security incident.

• Be able to work in a team to resolve differing viewpoints to create a governance portfolio.

• Apply structured governance techniques to acquire IT systems with security built in.

• Comprehend the importance of leadership and the balance of decision rights and escalation paths whether that is between people or machines.

• Be able to specify a security architecture and evaluate for vulnerabilities.

• Be able to identify and select appropriate metrics to monitor the security of an information system.

Analytical skills

Group/team working

Innovation/creativity

Leadership

Project management

Oral communication

Problem solving

Research

Written communication

1. Security RACI - Responsibility, Accountability, Consulted and Informed
   • Leadership
   • Managing investments
   • IT and audit working together
2. Strategic security
   • Risk management
   • Information security
   • Implementation roadmap
   • Architectures
3. Security during acquisition
   • The business case
   • Supplier governance
4. Performance of security measures
   • Capability assessment
   • IT service continuity
   • Performance measurement
5. Conformance of information systems to security obligations
   • Legal and regulatory aspects
6. Managing the human behaviour affecting the security of information systems
   • Communications

Lectures

70% of contact time will be lectures.

Laboratories

30% of contact time will be group work in the lab.

This is an interactive module with in-class sessions and an on-line discussion board that operates through the week to keep up the pace between contact days.