Overview
This unit provides you with a thorough understanding of the managerial aspects of information security in a business organisation. You will complement your existing knowledge of information and communication technologies by studying the organisational and management issues relevant to information security. You will learn about the importance of information security plans, security risk management and compliance monitoring, and develop and apply security policies and best practices. Through case studies, you will consider information security strategies that support business objectives while being aware of legal and ethical obligations. As a result, you will have the knowledge and skills to contribute to information security governance in accordance with standards set by governments, professional bodies and industry.
Details
Pre-requisites or Co-requisites
Prerequisite: COIT20261 Network Routing and Switching
Important note: Students enrolled in a subsequent unit who failed their pre-requisite unit, should drop the subsequent unit before the census date or within 10 working days of Fail grade notification. Students who do not drop the unit in this timeframe cannot later drop the unit without academic and financial liability. See details in the Assessment Policy and Procedure (Higher Education Coursework).
Offerings For Term 3 - 2026
Attendance Requirements
All on-campus students are expected to attend scheduled classes - in some units, these classes are identified as a mandatory (pass/fail) component and attendance is compulsory. International students, on a student visa, must maintain a full time study load and meet both attendance and academic progress requirements in each study period (satisfactory attendance for International students is defined as maintaining at least an 80% attendance record).
Recommended Student Time Commitment
Each 6-credit Postgraduate unit at CQUniversity requires an overall time commitment of an average of 12.5 hours of study per week, making a total of 150 hours for the unit.
Class Timetable
Assessment Overview
Assessment Grading
This is a graded unit: your overall grade will be calculated from the marks or grades for each assessment task, based on the relative weightings shown in the table above. You must obtain an overall mark for the unit of at least 50%, or an overall grade of 'pass' in order to pass the unit. If any 'pass/fail' tasks are shown in the table above they must also be completed successfully ('pass' grade). You must also meet any minimum mark requirements specified for a particular assessment task, as detailed in the 'assessment task' section (note that in some instances, the minimum mark for a task may be greater than 50%). Consult the University's Grades and Results Policy for more details of interim results and final grades.
All University policies are available on the CQUniversity Policy site.
You may wish to view these policies:
- Grades and Results Policy
- Assessment Policy and Procedure (Higher Education Coursework)
- Review of Grade Procedure
- Student Academic Integrity Policy and Procedure
- Academic Progression Policy and Procedure
- Student Refund and Credit Balance Policy and Procedure
- Complaints Policy and Procedure
- Information and Communications Technology Acceptable Use Policy and Procedure
This list is not an exhaustive list of all University policies. The full list of University policies are available on the CQUniversity Policy site.
Feedback, Recommendations and Responses
Every unit is reviewed for enhancement each year. At the most recent review, the following staff and student feedback items were identified and recommendations were made.
Feedback from Teaching Staff
In-class tests were useful, with scope to include more challenging practical questions based on tutorial activities.
Include more practical and challenging questions aligned with the tutorial activities in future in-class tests.
Feedback from Unit Coordinator’s Reflection
The Collaborative Reflective Circle (CRC) is currently included in Assessment 3, but not in the other two assessment tasks: the in-class test and the presentation.
Consider integrating CRC activities into additional assessments (such as group-based presentations) to further support collaboration and reflective learning.
- Develop security policies and program for an organisations based on national and international standards and industry's best practice
- Apply appropriate security control mechanism to protect critical infrastructure
- Assess security risks and develop risk management strategies for an organisation
- Justify appropriate risk treatment options
- Integrate laws and ethics of information security management into the organisation's security framework.
- Information Management (IRMG)
- Information Security (SCTY)
- Risk Management (BURM);
- Continuity Management (COPL)
- Methods and Tools (METL)
The National Initiative for Cybersecurity Education (NICE) Framework defines knowledge, skills and tasks needed to perform various cyber security roles. Developed by the National Institute of Standards and Technology (NIST), the NICE Framework is used by organisations to plan their workforce, including recruit into cyber security positions.
This unit helps prepare you for roles such as Systems Security Analyst, Network Operations Specialist and Systems Administrator, contributing to the following knowledge and skills:
- K0002 Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
- K0003 Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.
- K0004 Knowledge of cybersecurity and privacy principles.
- K0038 Knowledge of cybersecurity and privacy principles used to manage risks related to the use, processing, storage, and transmission of information or data.
- K0040 Knowledge of vulnerability information dissemination sources (e.g., alerts, advisories, errata, and bulletins).
- K0263 Knowledge of information technology (IT) risk management policies, requirements, and procedures.
- K0267 Knowledge of laws, policies, procedures, or governance relevant to cybersecurity for critical infrastructures.
- K0276 Knowledge of security management.
Alignment of Assessment Tasks to Learning Outcomes
| Assessment Tasks | Learning Outcomes | ||||
|---|---|---|---|---|---|
| 1 | 2 | 3 | 4 | 5 | |
| 1 - In-class Test(s) - 30% | |||||
| 2 - Presentation - 30% | |||||
| 3 - Written Assessment - 40% | |||||
Alignment of Graduate Attributes to Learning Outcomes
| Graduate Attributes | Learning Outcomes | ||||
|---|---|---|---|---|---|
| 1 | 2 | 3 | 4 | 5 | |
| 1 - Knowledge | |||||
| 2 - Communication | |||||
| 3 - Cognitive, technical and creative skills | |||||
| 4 - Research | |||||
| 5 - Self-management | |||||
| 6 - Ethical and Professional Responsibility | |||||
| 7 - Leadership | |||||
| 8 - First Nations Knowledges | |||||
| 9 - Aboriginal and Torres Strait Islander Cultures | |||||
Textbooks
There are no required textbooks.
IT Resources
- CQUniversity Student Email
- Internet
- Unit Website (Moodle)
No referencing style set.
m.elkhodr@cqu.edu.au
Week 1
Begin Date: 09 Nov 2026Module/Topic
Introduction to the Management of Information Security
Chapter
Chapter 1
Events and Submissions/Topic
Tutorial 1
Week 2
Begin Date: 16 Nov 2026Module/Topic
Governance and Strategic Planning for Security
Chapter
Chapter 2
Events and Submissions/Topic
Tutorial 2
Week 3
Begin Date: 23 Nov 2026Module/Topic
Risk Management: Assessing Risk
Chapter
Chapter 3
Events and Submissions/Topic
Tutorial 3
Week 4
Begin Date: 30 Nov 2026Module/Topic
Risk Management: Treating Risk
Chapter
Chapter 4
Events and Submissions/Topic
Tutorial 4
Week 5
Begin Date: 07 Dec 2026Module/Topic
Cybersecurity Policy
Chapter
Chapter 6
Events and Submissions/Topic
Tutorial 5
Week 6
Begin Date: 14 Dec 2026Module/Topic
Developing the Security Program
Chapter
Events and Submissions/Topic
Assessment 1 - Online Quiz (30%) open online Monday to Friday of this week; closes Friday 11:45 pm. Tutorial 6
Online Quiz Due: Week 6 Friday (18 Dec 2026) 11:45 pm AEST
Mid-Term Break
Begin Date: 21 Dec 2026Module/Topic
Mid-term break
Chapter
Events and Submissions/Topic
No scheduled classes
Week 7
Begin Date: 04 Jan 2027Module/Topic
Assessment 3 workshop
Chapter
Events and Submissions/Topic
Assessment 3 workshop. Tutorial 7
Week 8
Begin Date: 11 Jan 2027Module/Topic
Planning for Contingencies
Chapter
Chapter 10
Events and Submissions/Topic
Assessment 2 - Group Presentation (30%): slides and PDF (and recording, if used) due Monday 11:45 pm via Moodle; present in class on Tuesday (live or recorded, as directed by the Unit Coordinator). Tutorial 8
Group Presentation Due: Week 8 Monday (11 Jan 2027) 11:45 pm AEST
Week 9
Begin Date: 18 Jan 2027Module/Topic
Protection Mechanisms
Chapter
Chapter 12
Events and Submissions/Topic
Tutorial 9
Week 10
Begin Date: 25 Jan 2027Module/Topic
Compliance: Law and Ethics
Chapter
Events and Submissions/Topic
Tutorial 10
Week 11
Begin Date: 01 Feb 2027Module/Topic
Management Models
Chapter
Events and Submissions/Topic
Tutorial 11
Week 12
Begin Date: 08 Feb 2027Module/Topic
Cybersecurity Maintenance
Chapter
Events and Submissions/Topic
Assessment 3 - Group Written Assessment (40%) due Friday 11:45 pm. Tutorial 12
Group Written Assessment Due: Week 12 Friday (12 Feb 2027) 11:45 pm AEST
Exam Week
Begin Date: 15 Feb 2027Module/Topic
Exam week
Chapter
Events and Submissions/Topic
No examination in this unit
This unit is offered online at all campuses.
For any queries, contact the Unit Coordinator, Dr Mahmoud Elkhodr, at m.elkhodr@cqu.edu.au
1 In-class Test(s)
You will complete a time-limited online quiz in Moodle consisting of auto-marked items (for example, multiple choice, matching, short interpretation/calculation). The quiz checks your grasp of core concepts and their practical application so that you are ready for the later assessments.
Coverage: Weeks 1-5 (introduction; governance and strategic planning; risk assessment; risk treatment; policy).
Conditions: Individual work, closed book, no collaboration or external aids unless specified in an approved Accessibility plan.
Week 6 Friday (18 Dec 2026) 11:45 pm AEST
Quiz open online for the whole of Week 6; attempt it at any time during the week
Week 8 Monday (11 Jan 2027)
Marks and results returned two weeks after submission
This quiz is auto-marked. Marks are awarded for correct responses to each question, with the mark value for each item shown in the quiz. The total quiz mark is converted to the 30% weighting for this assessment.
- Develop security policies and program for an organisations based on national and international standards and industry's best practice
- Assess security risks and develop risk management strategies for an organisation
- Justify appropriate risk treatment options
- Integrate laws and ethics of information security management into the organisation's security framework.
2 Presentation
In a group of 3-4 students, you will use the SAGE (Structured AI-Guided Education) framework to develop a telehealth Issue-Specific Security Policy (ISSP) for the Koala Health case study. Tasks: (1) generate an initial ISSP using an approved generative AI tool; (2) evaluate the AI output against the Kim et al. (2020) telemedicine threat areas, the ACSC Essential Eight and Australian healthcare legislation, identifying at least six substantive problems; (3) refine it into a final ISSP of approximately 2,000-2,500 words; (4) obtain an AI critique of the refined policy and respond to the critique points; and (5) write a 500-word group reflection.
Submit your PPT slides plus a single PDF containing the final ISSP, the evaluation table, the critique response table, the reflection and appendices (AI interaction log, original AI policy draft, AI critique) via Moodle by 11:45 pm on the Monday of Week 8.
You will present your work in class on the Tuesday of Week 8 (8-10 minutes), either live or as a recorded presentation, as directed by the Unit Coordinator. A recorded presentation must also be submitted by the Monday deadline. Specific details are provided on Moodle.
Conditions: All team members must contribute. All AI use must be documented, and citations must be shown where external sources or textbook content are referenced.
Week 8 Monday (11 Jan 2027) 11:45 pm AEST
Slides and PDF (and recording, if used) due Monday of Week 8 via Moodle; present in class on Tuesday of Week 8 (12 Jan 2027), live or recorded as directed by the Unit Coordinator
Week 10 Monday (25 Jan 2027)
Marks and feedback returned two weeks after submission
Your submission will be assessed against the following criteria:
Framework-Based Evaluation (25%): quality and depth of analysis of the AI output using the Kim et al. threat areas and Essential Eight controls; accuracy of framework citations; identification of substantive security and compliance deficiencies
Policy Quality (30%): coverage of all seven threat areas and applicable Essential Eight controls; specificity and actionability of policy statements; appropriate structure and professional presentation
Regulatory Alignment (20%): correct identification and application of Australian healthcare legislation; understanding of regulatory requirements; appropriate compliance mechanisms
AI Critique Response (15%): quality of professional judgement in responding to AI feedback; strength of justifications referencing frameworks and regulations; evidence of critical thinking
Reflection Quality (10%): depth of metacognitive analysis; specificity of AI limitation examples against frameworks; quality of recommendations for organisational practice
The tutorial presentation contributes to the overall assessment.
- Develop security policies and program for an organisations based on national and international standards and industry's best practice
- Apply appropriate security control mechanism to protect critical infrastructure
- Integrate laws and ethics of information security management into the organisation's security framework.
3 Written Assessment
Working in the same group, you will produce an integrated risk management and incident response report (approximately 4,000 words excluding tables and appendices, professional report style with headings) for the Koala Health case study, using the SAGE framework. The report must include: (1) a risk landscape analysis, with an AI-generated risk assessment critically evaluated and a risk register for 12-15 critical assets using Likelihood x Impact ratings; (2) a risk treatment and control architecture for the top 8 risks, aligned to the ACSC Essential Eight and cloud security requirements, with responses to AI critique; (3) an incident response plan for a third-party (pathology provider) data breach scenario covering all five phases of the incident response lifecycle; and (4) a 500-word critical reflection.
Appendices: AI interaction log, original AI-generated risk assessment, and AI critiques.
Briefly indicate how the policy elements from Assessment 2 provide authority and governance for your proposed controls and processes.
Coverage: Weeks 1-11. Conditions: Original group work; all group members must contribute substantially, and peer evaluation may be used to moderate individual marks. All AI use must be documented and proper citation used.
Week 12 Friday (12 Feb 2027) 11:45 pm AEST
Week 12 Friday
Grades and feedback will be returned on grade finalisation day
Your submission will be assessed against the following criteria:
Risk Analysis Quality (30%): depth and accuracy of risk identification; appropriate application of the Kim et al. threat taxonomy and industry-validated dimensions; quality of likelihood and impact justifications; identification of AI assessment gaps
Treatment Strategy (30%): appropriateness of treatment strategy selection; alignment with Essential Eight controls; integration of cloud security considerations; quality of implementation planning; contextualisation to the operational environment
Incident Response (20%): completeness of response across all phases; appropriateness of actions for the scenario; awareness of regulatory requirements; integration with risk treatment decisions
AI Critique Response (10%): quality of professional judgement in responding to AI feedback; strength of justifications for accepting, modifying or rejecting recommendations; evidence of critical thinking
Reflection Quality (5%): depth of metacognitive analysis; specificity of AI limitation examples; comparison across assessment tasks; actionable recommendations
Professional Presentation (5%): document structure and organisation; clarity of writing; appropriate use of tables; correct referencing; adherence to submission requirements
Peer evaluation may be used to moderate individual marks.
- Apply appropriate security control mechanism to protect critical infrastructure
- Assess security risks and develop risk management strategies for an organisation
- Justify appropriate risk treatment options
As a CQUniversity student you are expected to act honestly in all aspects of your academic work.
Any assessable work undertaken or submitted for review or assessment must be your own work. Assessable work is any type of work you do to meet the assessment requirements in the unit, including draft work submitted for review and feedback and final work to be assessed.
When you use the ideas, words or data of others in your assessment, you must thoroughly and clearly acknowledge the source of this information by using the correct referencing style for your unit. Using others’ work without proper acknowledgement may be considered a form of intellectual dishonesty.
Participating honestly, respectfully, responsibly, and fairly in your university study ensures the CQUniversity qualification you earn will be valued as a true indication of your individual academic achievement and will continue to receive the respect and recognition it deserves.
As a student, you are responsible for reading and following CQUniversity’s policies, including the Student Academic Integrity Policy and Procedure. This policy sets out CQUniversity’s expectations of you to act with integrity, examples of academic integrity breaches to avoid, the processes used to address alleged breaches of academic integrity, and potential penalties.
What is a breach of academic integrity?
A breach of academic integrity includes but is not limited to plagiarism, self-plagiarism, collusion, cheating, contract cheating, and academic misconduct. The Student Academic Integrity Policy and Procedure defines what these terms mean and gives examples.
Why is academic integrity important?
A breach of academic integrity may result in one or more penalties, including suspension or even expulsion from the University. It can also have negative implications for student visas and future enrolment at CQUniversity or elsewhere. Students who engage in contract cheating also risk being blackmailed by contract cheating services.
Where can I get assistance?
For academic advice and guidance, the Academic Learning Centre (ALC) can support you in becoming confident in completing assessments with integrity and of high standard.
What can you do to act with integrity?
