Courses
32 courses that end with a deliverable.
Each one starts from a question a practitioner actually asks. 8 are free in full — and the first lesson of every other course stays open, so you can judge the writing before paying for any of it.
- courses
- 32courses
- free, in full
- 8free, in full
- standards, clause by clause
- 33standards, clause by clause
- of written content
- 26 hof written content
32 courses
24 of them open with Practitioner
Start here
Free in full. No card, no trial clock.
Business Continuity Fundamentals
The vocabulary, the lifecycle and the reflexes that structure the whole discipline
Use the normative vocabulary without approximation
- ISO 22301
- ISO 22300
- BCI Good Practice Guidelines
- +1
Operational Resilience Fundamentals
Why regulators changed their vocabulary — and what it changes
Explain the shift from process to service
- BCBS 516 — Principes de résilience opérationnelle
- PRA SS1/21 & FCA PS21/3
- ISO 22316
- +1
Operational Risk Fundamentals
The only risk you can neither hedge nor diversify
Define operational risk without conflating it with compliance risk
- BCBS 195 / PSMOR (révisé 2021)
- ISO 31000
- COSO ERM 2017
Running a BIA that holds
Three levels, one impact scale, and durations management owns
Structure a BIA in three levels and avoid bogging down
- ISO/TS 22317
- ISO 22301
- BCI Good Practice Guidelines
Continuity strategies and solutions
The step everybody skips, and that decides everything
Derive a strategy per resource category
- ISO/TS 22331
- ISO 22301
- NIST SP 800-34 Rev. 1
Writing plans people can use
Write for someone who is frightened, at night, without their laptop
Structure a coherent plan architecture
- ISO 22301
- BCI Good Practice Guidelines
- ISO 22320
Implementing an ISO 22301 BCMS
From the certification decision to the first surveillance audit
Sequence a twelve-month certification project
- ISO 22301
- ISO 22313
- ISO/IEC 27001
Identifying important services and tolerances
The list that commits the board, and the numbers it will have to defend
Produce a defensible list of important services
- PRA SS1/21 & FCA PS21/3
- BCBS 516 — Principes de résilience opérationnelle
- Règlement (UE) 2022/2554 — DORA
End-to-end mapping
Six layers, down to tier-2 third parties, to find the breaking points
Map six resource layers per service
- BCBS 516 — Principes de résilience opérationnelle
- Règlement (UE) 2022/2554 — DORA
- PRA SS1/21 & FCA PS21/3
Testing severe but plausible scenarios
Building scenarios that hurt without becoming implausible
Calibrate scenario severity without losing plausibility
- BCBS 516 — Principes de résilience opérationnelle
- PRA SS1/21 & FCA PS21/3
- Règlement (UE) 2022/2554 — DORA
- +1
Running an RCSA campaign
Surface decisions, not fill a matrix
Structure an RCSA campaign in six weeks
- BCBS 195 / PSMOR (révisé 2021)
- ISO 31000
- IEC 31010
Loss data collection and key risk indicators
A database that drives decisions, indicators that give warning
Set a collection threshold that captures useful information
- BCBS 195 / PSMOR (révisé 2021)
- ISO 31000
Scenario analysis and quantification
Quantifying the extreme when history says nothing
Build a library of extreme scenarios
- BCBS 195 / PSMOR (révisé 2021)
- IEC 31010
- ISO 31000
IT Continuity Fundamentals
Availability, continuity, recovery: three questions, three architectures
Distinguish high availability, continuity and recovery
- ISO/IEC 27031
- NIST SP 800-34 Rev. 1
- ITIL 4 — Service Continuity Management
Designing a recovery architecture
From business need to infrastructure design, with its cost
Choose a topology matched to the RTO actually available
- ISO/IEC 27031
- NIST SP 800-34 Rev. 1
- Uptime Institute Tier Standard
- +1
Backups, immutability and restoration
Designing backups that survive a compromised administrator
Apply the 3-2-1-1-0 rule and understand each digit
- Règlement (UE) 2022/2554 — DORA
- CIS Controls v8.1
- ISO/IEC 27031
- +1
Testing and measuring a DR plan
Time it, don't confirm it
Build a graduated test programme
- ISO/IEC 27031
- Règlement (UE) 2022/2554 — DORA
- ISO 22398
Crisis Management Fundamentals
Deciding before you know what is happening
Characterise a crisis and trigger at the right level
- ISO 22361
- ISO 22320
- ISO 22300
Staffing and running a crisis team
Roles, battle rhythm, and the discipline that prevents burnout
Define non-overlapping roles
- ISO 22361
- ISO 22320
Crisis communication
Say little, say true, say fast — in that order
Draft a holding statement in under fifteen minutes
- ISO 22361
- Règlement (UE) 2022/2554 — DORA
- Directive (UE) 2022/2555 — NIS 2
Designing and facilitating exercises
A successful exercise is one that reveals a gap
Define measurable exercise objectives
- ISO 22398
- ISO 22301
- ISO 22361
DORA at a glance
Five pillars, twenty entity categories, one personal accountability
Determine whether an entity is in scope
- Règlement (UE) 2022/2554 — DORA
- Directive (UE) 2022/2555 — NIS 2
- EBA/GL/2019/04
ICT risk management framework
Articles 5 to 16: what the board must be able to approve
Structure the framework around the expected deliverables
- Règlement (UE) 2022/2554 — DORA
- EBA/GL/2019/04
- ISO/IEC 27001
Incident classification and reporting
The clock starts at classification, not at detection
Build an operational classification grid
- Règlement (UE) 2022/2554 — DORA
- Directive (UE) 2022/2555 — NIS 2
- NIST SP 800-61 Rev. 3
ICT third-party risk and register of information
The most underestimated deliverable in the regulation
Produce a register matching the authorities' template
- Règlement (UE) 2022/2554 — DORA
- EBA/GL/2019/02
- ISO/TS 22318
Resilience testing and TLPT
From the mandatory annual test to authority-supervised red teaming
Structure a multi-year testing programme
- Règlement (UE) 2022/2554 — DORA
- TIBER-EU
Cyber Resilience Fundamentals
Designing for after the compromise
Position the six NIST CSF 2.0 functions
- NIST Cybersecurity Framework 2.0
- NIST SP 800-61 Rev. 3
- ISO/IEC 27001
- +1
Responding to ransomware
The first six hours, decision by decision
Run the first six hours
- NIST SP 800-61 Rev. 3
- Règlement (UE) 2022/2554 — DORA
- Directive (UE) 2022/2555 — NIS 2
- +1
Connecting cyber and continuity
Two management systems, one capability
Identify the clauses shared by both standards
- ISO/IEC 27001
- ISO 22301
- NIST Cybersecurity Framework 2.0
- +1
Third-Party Risk Fundamentals
Important is not critical, and large is not important
Distinguish criticality from spend
- ISO/TS 22318
- EBA/GL/2019/02
- Règlement (UE) 2022/2554 — DORA
- +1
Due diligence and contract clauses
A clause with no audit right and no joint test proves nothing
Build proportionate due diligence
- EBA/GL/2019/02
- Règlement (UE) 2022/2554 — DORA
- ISO/TS 22318
Concentration and exit strategies
Knowing how to leave before you are forced to
Measure concentration beyond tier 1
- Règlement (UE) 2022/2554 — DORA
- EBA/GL/2019/02
- BCBS 516 — Principes de résilience opérationnelle
A track costs less than its courses.
Each track chains its courses in the order the discipline is built, applies a quarter off the total, and ends on a certification.