Service
Cybersecurity Management Academy
A practical programme for small and medium-sized companies that have no cybersecurity specialist and want to prepare their own person to take on this role. We teach how to stop an attack from bringing the company to a halt or robbing it, and how to manage the topic day to day with the board and the IT provider.
At a glance
- 18 online sessions of 2 hours, twice a week
- 36 hours of classes, with exercises in small groups in every session
- a project that runs through the whole programme, with written feedback
- 3 individual consultations with a project supervisor
- groups of up to 15 people
- a certificate of completion after the project defence
Why a company needs this person
In a company without a specialist, cybersecurity is usually the IT person's job or nobody's. The IT person keeps the systems running, but no one decides which risks matter most, how much to spend on them and who is responsible when something happens.
A company can be brought to a halt or robbed by very mundane events: a changed bank account number on an invoice, a hijacked mailbox, ransomware that encrypts data, or an outage at a supplier the whole company depends on.
On top of that come external requirements. Clients send security questionnaires and write requirements into contracts, insurers ask about safeguards when renewing a policy, and some companies are subject to the Polish National Cybersecurity System Act. Someone in the company has to be able to put this in order and keep an eye on it. The Academy prepares exactly that person.
What graduates can do
After the programme, a graduate can:
- Identify what could realistically bring the company to a halt or rob it, and propose priorities and a budget to the board.
- Establish what clients, the insurer, contracts and regulations require of the company, including whether it is subject to the National Cybersecurity System Act.
- Describe what has to work for the company to work, and point out the elements whose failure stops the whole company.
- Set concrete requirements for the IT provider and check that they are met.
- Introduce short rules that people actually follow, and show with evidence that safeguards work.
- Lead the company through the first hours of an incident and meet the applicable reporting deadlines.
- Check whether backups will let the company get back to work within an acceptable time.
- Answer a client's security questionnaire or an insurer's questionnaire without claims that cannot be proven.
- Plan staff awareness activities, especially where the company loses money to fraud.
- Report regularly to the board on the state of security and the decisions to be made.
What the company gains
Its own person responsible for cybersecurity
Someone who knows how to perform this role, instead of relying solely on external firms.
A counterpart for the IT provider
Someone who knows what to ask, what to require and how to check the answer.
Better board decisions
Priorities and a budget justified by the impact on the company, not by a sales offer or a trend.
Readiness for questions from clients and insurers
Answers based on evidence, not on declarations.
Less chaos during an incident
Everyone knows who decides, whom to notify and by when.
How we work
The Academy is practice under the guidance of trainers, not a lecture series.
Little lecturing, lots of exercises
Each two hour session is a short content part with examples, an exercise in small groups and a project task for the next session.
Example companies
We practise on fictional companies based on real situations, for example a chain of clinics or an accounting firm. No one reveals their own company's safeguards.
A project from start to finish
Throughout the programme, each participant builds a cybersecurity management plan for an example company. Each module adds another part.
Feedback and consultations
Trainers assess each of the three project stages in writing, and the project supervisor holds three 30 minute consultations with each participant.
Defence
At the end, the participant presents the plan to a panel that asks questions like a board deciding on the budget and a client asking for evidence.
A small group
Up to 15 people, so everyone has time for questions, discussion and group work with the trainers.
The programme, module by module
Eight modules lead from the question "what could bring the company to a halt" to a quarterly board report. Each ends with an exercise and another part of the project.
- How small and medium-sized companies are really attacked: bank account change fraud and CEO fraud, Microsoft 365 mailbox takeover, ransomware, an incident at a supplier.
- What an incident costs: downtime, lost orders, liability towards clients, management time, a higher insurance premium.
- The role of the person responsible: what belongs to the board, what to them and what to the IT provider.
- Where requirements come from: clients, insurers, tenders, GDPR, the National Cybersecurity System Act. How to check whether the company is subject to the Act.
Exercise: which attacks would stop the exercise company for more than a day, and who is responsible for what.
In the project: a description of threats and requirements for the example company, and the allocation of responsibilities.
- From services to systems: what has to work for the company to sell.
- How much detail a register needs and where to get the data.
- Dependencies and single points of failure: suppliers, cloud, connections, key people, knowledge held by one person.
- Tools used without IT's knowledge, including AI tools.
Exercise: a dependency map of the exercise company.
In the project: a register of services and systems with a dependency map.
- Risk in business terms: financial impact, downtime, data, clients, external requirements.
- Eight scenarios that most often affect small and medium-sized companies, and how to assess them.
- What to do with risk: reduce, insure, avoid or consciously accept it. Who decides.
- The technical minimum to require from IT, and proportionate sets of safeguards for small companies.
- Priorities and a budget for two quarters, and how to present them to the board.
Exercise: assessing scenarios, comparing safeguards with an insurer's questionnaire, choosing priorities with a cost estimate.
In the project: a risk analysis, priorities and a budget.
- What minimum set of rules a company needs, and why purchased templates more often harm than help.
- Access and permissions, employee departures, backups, updates, encryption, payments and changes to supplier details, remote work.
- Safe use of AI tools in the company: what is allowed, what not to paste, how to protect data.
- What counts as evidence that a safeguard works, and how to prepare for a client audit, insurer questions or an inspection.
Exercise: a permissions gap when an employee leaves, "evidence or declaration", answering questions from a hospital's questionnaire.
In the project: a list of rules to introduce and an evidence calendar.
- The first hour of an incident: who decides, what not to do, how to work with the IT provider.
- Bank account fraud: what to do with the bank in the first hours.
- Notifications: the Personal Data Protection Office (UODO), the insurer, the police, clients, and for companies subject to the National Cybersecurity System Act also the CSIRT.
- How long the company can survive downtime and whether backups allow for it. Why only a restore test proves that a backup works.
- A tabletop exercise: a ransomware attack in four rounds, with decisions under time pressure and crisis communication.
Exercise: classifying events, comparing continuity requirements with a backup report, the tabletop exercise.
In the project: an incident handling procedure, continuity requirements and a restore test plan.
- Which suppliers are critical and how to assess them. What supplier certificates and reports show, and what they do not prove.
- Cloud and Microsoft 365: what the provider is responsible for and what stays with the company.
- Security requirements in contracts and data processing agreements.
- What the IT provider should report every month and how to talk to them without technical knowledge.
- The company as a supplier: answering client questionnaires and insurer questionnaires.
Exercise: assessing suppliers, analysing a service contract, answering an insurer's questionnaire.
In the project: a list of critical suppliers, requirements for the IT provider and an answer to a questionnaire.
- An awareness programme: whom to train, on what, how often and how to measure the effect.
- Social engineering in practice: a changed bank account, an order "from the CEO", a fake IT department, a call "from the bank".
- A reporting culture in which employees are not afraid to admit to a click.
- How to communicate changes that employees will not like.
Exercise: an announcement introducing multi-factor authentication and a conversation with accounting about verifying bank accounts.
In the project: an annual awareness and communication plan.
- What the board should approve and how often.
- Metrics with a data source, and a quarterly report on one page.
- Why basic safeguards are not ambitious goals, and what goes into quarterly objectives.
Exercise: metrics and a report for the exercise company, a quarterly objective with key results.
In the project: metrics, objectives for two quarters and the structure of the board report.
Each participant presents the plan for their example company: an 8 minute presentation and 5 minutes of questions from the panel. At the close, we sum up the programme and discuss how to transfer the practised method to your own company.
The project, step by step
The project is a cybersecurity management plan for an example company, built throughout the programme in three stages and completed with a defence. The participant does the same work they will do in their own company after the Academy.
- Stage one: which threats and requirements apply to the company, who is responsible for what, which services and systems have to work and what they depend on.
- Stage two: a scenario based risk analysis, priorities and a budget for two quarters.
- Stage three: rules to introduce and an evidence calendar, an incident handling procedure, business continuity requirements, a supplier assessment and an answer to a client questionnaire or an insurer's questionnaire.
- Final plan: a staff awareness programme, metrics, objectives for two quarters and a board report, presented at the defence.
After each stage, the participant receives written feedback, and between stages has consultations with the project supervisor. Each participant also gets their own variant of the example company, with a few different facts, so projects do not duplicate each other.
Format and organisation
Sessions
18 online sessions of 2 hours, twice a week, during working hours.
Duration
About 9 weeks of classes and a one week break to finish the project before the defences.
Format
Live classes in Microsoft Teams, with group work. Sessions are not recorded, because their value lies in working together, not in the lecture itself.
Workload
About 6 hours a week: 4 hours of classes and about 2 hours of project work.
Materials
After each session, slides in PDF, a worksheet and a description of the project task.
Certificate of completion
After attending at least 15 of 18 sessions, submitting the three project stages and defending the plan.
We will announce the start date once the group is formed.
Who it is for
For the person who is to take over responsibility for cybersecurity in their company, including without prior experience in the field. Typically an IT manager or administrator, an administration or finance manager, a quality representative, a data protection officer or a board member of a small company.
The Academy is also for people who already have this responsibility but were never prepared for it.
The programme is designed for companies with roughly several dozen to 250 employees, regardless of industry and of whether the company is subject to the National Cybersecurity System Act.
Requirements
- No technical knowledge is needed. A general understanding of how the company and its IT work is enough.
- The employer's consent to attend classes during working hours.
- About 6 hours a week throughout the programme.
What the Academy does not do
It is not a technical course
It does not teach system administration or penetration testing. Graduates set requirements for the IT provider and check that they are met.
It is not a course on regulations
We discuss regulations where they follow from risk and apply to the company, not for their own sake.
It does not do the work in your company
It prepares the person who will, practising on example companies instead of your data.
It does not award a competence certificate
It confirms completion of the programme, not competence under ISO/IEC 17024, and does not authorise the audit under Article 15 of the National Cybersecurity System Act.
It is not a postgraduate degree or an MBA
It is a practical training programme for companies, focused on one role: the person responsible for cybersecurity.
Frequently asked questions
No. The programme teaches cybersecurity management: decisions, priorities, requirements and oversight. Where technology is involved, we teach what to require from the IT provider and how to check that it has been done.
No. The programme is for any small or medium-sized company that wants its own person responsible for cybersecurity. Companies outside the Act receive similar requirements from clients, insurers and contracts anyway.
In terms of management, yes. The programme covers all ten areas of measures required of entities subject to the Act, but treats regulations as one source of requirements, not as an end in itself. Technical areas such as cryptography and secure communication are covered at the level of requirements for the IT provider.
No. Exercises and the project are based on example companies. This way no one reveals their organisation's safeguards to other participants, and trainers can assess everyone's work against the same criteria.
For running the topic day to day, yes; for specialist tasks, not always. A graduate is the internal owner of cybersecurity: they coordinate, monitor and report. For more complex tasks it is still worth using external support, but the company will know what it needs and how to check the result.
No. The value of the sessions lies in live group work and discussion with the trainers, which a recording cannot replace.
Participants receive the slides and the trainer's notes. Completion requires attending at least 15 of 18 sessions.
Graduates receive a numbered certificate of completion. It is not a certificate of competence within the meaning of ISO/IEC 17024 or an authorisation to carry out the audit under Article 15 of the National Cybersecurity System Act.
Yes. We agree terms for several people from one company individually.
The group starts once we have enough registrations. We will send the start date to everyone registered before the group is launched.
Registration
Registration is open. We launch the group once we have enough registrations, and places are limited to 15.
- Fill in the form below. You can register one or more people from your company.
- Before the group is launched, we will send everyone registered the start date, the schedule and the terms of participation.
- We charge the fee only after the start of the group is confirmed, based on an invoice.
Our trainers are practitioners who work daily in security management, audit and communication. We will announce the trainers before the group starts.
The terms of registration and cancellation are set out in the training terms and conditions.