STUDY GUIDE · GKU 8
Organisational security: ethics, law, risk and economics study guide (Cybersecurity)
An organisation is secure only when its decisions are lawful, ethical and affordable at the same time. This unit covers the three disciplines that make that true. The first is law and ethics: the professional codes that bind a security practitioner, responsible disclosure and whistleblowing, the Saudi instruments an organisation must comply with (the Anti-Cybercrime Law, the PDPL, the NCA ECC, the SAMA CSF and the CST), the international ones it may also face (the GDPR, ISO/IEC 27001 and 27002, NIST CSF 2.0), and the judicial and CERT machinery that handles a cross-border case. The second is risk: the vocabulary of asset, threat, vulnerability and impact, appetite and tolerance, qualitative and quantitative methods, the risk register, treatment options and the policy that turns assessment into rules. The third is money and communication: single and annualised loss expectancy, control value, ROSI, NPV, insurance, and how to present a security decision to a board in business terms. The quantitative examples are short, fully worked, and every figure is given data rather than a measured loss.
Structured by the official ETEC subject standard for this topic: every listed topic and learning outcome, with formulas, figures and worked examples. The full sections are available to members in the app.
SKU 8.1 · Policy, legal and ethics aspects, and compliance
Professional ethics, legislation, standards and judicial frameworks
The duties in professional codes, responsible disclosure and whistleblowing, the Saudi and international instruments that govern data and cybersecurity, the principles of data protection, and the courts, CERTs and treaties that handle a case across borders.
SKU 8.2 · Security risk analysis
Risk principles, methods, lifecycle and treatment
The vocabulary of risk, appetite and tolerance, qualitative and quantitative methods and the frameworks the exam names, the lifecycle and the register, the four treatment options, and the three risk categories.
Risk economics, control value and board communication
Single and annualised loss expectancy, control cost, net benefit, ROSI and NPV, insurance and residual risk, and how to justify a security investment to a board without the classic residual-ALE fallacy.
MORE CYBERSECURITY GUIDES
- Cybersecurity foundations: principles, threats, risk and governance study guideGKU 1 · 3 sections
- Data security: cryptography, forensics and databases study guideGKU 2 · 6 sections
- Software security: development, secure coding, design and algorithms study guideGKU 3 · 5 sections
- Component security: architecture, vulnerabilities and environments study guideGKU 4 · 2 sections
- Network security study guideGKU 5 · 5 sections
- System security study guideGKU 6 · 4 sections
- Human security: threat actors, techniques and awareness study guideGKU 7 · 2 sections