Mobile device configuration essentials, and what staff must do before using a device for work.

Seven steps for choosing applications safely: consult IT, test first, and avoid unauthorized tools.

Credential strength as the foundation of every authentication control. Multi-factor authentication (MFA) and identity controls are covered further in Part 3, under requirement 05.

The difference between an event and an incident, and how staff should react to each.

Five incidents worked end to end: identity fraud, oversharing, online ordering, bank fraud, and parcel handling.

Five more incidents: access control, asset management, mobile devices, apps, and hybrid working.

Post-incident investigation, communication with the parties involved, and documentation for audit and containment.

Classification, labeling, secure exchange, and secure disposal of sensitive information.

Stricter handling for sensitive personal records across the whole data life cycle.

Secure email habits, calendar hygiene, and smarter digital communication workflows.

Wire fraud and business email compromise, the most common email-borne threat for organizations of any size.

Encryption, cryptography, and secure communication channels, including the fundamentals of email encryption.

Risk analysis, incident handling, business continuity, and supply chain security. This is the session that documents continuity as a training pillar.

Secure system development, effectiveness assessment, cyber hygiene, staff training, cryptography, and encryption.

Access control, asset tracking, authentication, secure communications, and emergency communication systems.

Defining security roles and making sure decisions are made at the right level. Key to administrator accountability.

Internal audits, documentation, and demonstrating compliance to auditors and management.

Remote working risks and the network and connection habits administrators are directly responsible for.