Become an effective CISO and lead cybersecurity

Cybersecurity must be managed in line with organisational risks and priorities. Structure your programme, clarify responsibilities and prepare trade-offs for discussions with management. Strengthen your security leadership beyond technical choices alone.

6 days 42 hours

GSI005FR Code

Overview & objectives

Presentation

As cyberattacks become more professional, the Chief Information Security Officer (CISO) has become central to organisational survival. This 6-day course teaches you to take on this strategic responsibility by mastering governance, regulatory obligations (NIS2, GDPR) and technical realities in the field.

This comprehensive CISO training programme gives you a complete view of the role. You will move between defining an Information Security Policy, crisis management and resilient architecture design. Particular emphasis is placed on the EBIOS Risk Manager method, with dedicated workshops turning risk analysis into a decision-making tool.

By the end of the course, you will be equipped to structure a comprehensive security approach that is credible to management and operationally useful to technical teams. You will have the tools to protect critical assets and ensure business continuity.

Objectives

By the end of this course, you will be able to:

identify the CISO's strategic duties and responsibilities;
master standards frameworks and legal obligations (GDPR, NIS2);
structure effective information security governance;
define an overall security strategy and associated action plan;
lead risk management and security incident handling;
ensure regulatory compliance and audit security levels;
deploy technical protection solutions for information systems and networks;
design robust, resilient security architectures;
develop and test business continuity and IT contingency plans;
manage human factors through awareness and training;
actively monitor threats and legal developments;
conduct regular audits to check the framework's effectiveness.

Program

Part 1: management aspects

Module 1: understand the CISO's role and duties

The CISO's role and duties.
Information security governance and its organisational position.
Current cybersecurity challenges and threats.

Module 2: master standards and the regulatory framework

Information security standards (ISO 27001, ISO 27005, ISO 22301, NIST).
Regulations and legal obligations (GDPR, LPM, NIS2, CLOUD Act).
The role of competent authorities (ANSSI, CNIL).

Module 3: define an effective information security strategy

Developing an information security policy.
Identity and access management.
Data protection and information classification.

Module 4: lead cyber risk management

Risk analysis methods (EBIOS RM, ISO 27005).
Threat identification and assessment.
Risk mitigation and treatment strategies.

Module 5: manage incidents and crisis response

The incident response plan.
Forensic analysis and crisis management.
Lessons learned and continuous improvement.

Module 6: ensure compliance and security auditing

Compliance audits and information security controls.
Cybersecurity indicators and dashboards.
Employee awareness and training.

Module 7: practise EBIOS Risk Manager methodology

Frame the study: define scope, missions and the security baseline.
Identify risk sources (OFE) and develop strategic scenarios.
Build operational scenarios and assess their likelihood.
Define the risk treatment strategy and security action plan.

Part 2: information security in practice

Module 8: deploy technical security solutions

Access security (strong authentication, identity controls, SSO and NAC).
Communication security and encryption (VPN, IPSec, TLS, PKI and WAF).
Server and endpoint security (EDR, antivirus and system hardening).
Application security and secure development.

Module 9: design architectures and segment information systems

Designing secure architectures.
Trust zones and DMZ implementation.
Firewalls and proxies: network and application filtering.
Monitoring and threat detection (SIEM, IDS/IPS).
SaaS and the SD-WAN approach.

Module 10: develop continuity and recovery plans

Developing a Business Continuity Plan (BCP).
Deploying a Disaster Recovery Plan (DRP).
Cyber crisis tests and simulations.
Crisis management and incident communication.

Module 11: manage human factors and awareness

Employee awareness and training.
Access and authorisation management.
Combating social engineering and phishing.

Module 12: monitor legal and regulatory developments

Compliance with standards and regulations (ISO 27001, GDPR, NIS2).
Managing legal obligations and incident notification.
Relations with competent authorities such as ANSSI.

Module 13: monitor and audit the information security framework

Assessing system compliance.
Planning and conducting security audits.
Action plan management and continuous improvement.

Audience & prerequisites Assessment methods Course highlights Dates & Sessions

Last update: 24/09/2026