Course revision guide

60 min 3 stages distilled 3 figures

The whole course in one place, arranged for revision. Each stage below gives you its figure, the distinctions worth holding in your head, and the fastest routes back into the full material. Skim the figures first, then test yourself against the distinctions: anything you cannot explain from memory points at the stage to revisit.

The cybersecurity course: four stages around one governing habit

Each stage hands the next one thing: a shared vocabulary, then design judgement, then an operating capability, with the Govern hub tied to all four, making governance something exercised at every stage rather than added once the technical work is done.

The course runs Foundations to Applied practice to Practice and strategy to Exam, each handing the next a capability, with Govern tied to every stage because risk-led decisions are made throughout, not at the end. Source: NIST CSF 2.0.

Stage 1: Threats, risk, identity and the human factors that decide most incidents

The NCSC working definition of cyber security and its three components

The NCSC definition fixes scope, subject and threat as three separate components, then places supply chain software, offsite backup tapes and smart-building controls inside the attack surface, so a reading limited to desktop computers misses most of what has to be defended.

The NCSC definition pins cyber security to three things: a broad scope, what is protected, and what it is protected from. Source: NCSC, ncsc.gov.uk.

Hold these distinctions

Cybersecurity protects systems and data from digital attack, IT security guards the technology, and information security covers information in every form including paper and speech
A threat is who might act, a vulnerability is the weakness they could use, and an exploit is the act that turns the weakness into harm; risk is the chance of all three combining
Risk appetite is how much risk an organisation seeks in pursuit of its goals; risk tolerance is how far it lets a specific risk drift before it must act
A one-time code proves possession of a device and is replayed by a proxy phishing kit; a passkey is bound to the genuine domain and refuses to sign in to the fake
Personal data identifies a living individual; special category data covers sensitive classes such as health and biometrics and carries extra conditions on processing
An incident is any event that may harm security; a breach is a confirmed compromise of data or systems, so most incidents never become breaches and the denominators differ
Cyber Essentials is a floor that removes commodity attacks; it is not an assurance of resistance to a targeted adversary

Full stage summary Scenario practice

Stage 2: Designing and verifying systems that resist attack

Worked data-flow diagram crossing two trust boundaries where threats live

A review is only as bounded as the diagram makes it: the two dashed boundaries are what pick out where to look, and an open question about whether the whole system is secure becomes a finite list of crossings to work through with STRIDE.

A DFD plus trust boundaries tells you where to focus threat hunting: every data flow that crosses a boundary is a place an attacker can sit. Source: Shostack 2014, OWASP Threat Modelling.

Hold these distinctions

Authentication proves who a caller is; authorisation decides what that caller may do, and at the API layer the dominant failure is authorisation, not authentication
OAuth 2.0 delegates limited access with an access token; OpenID Connect adds an ID token that proves identity, so an access token is not evidence of who the user is
SAST reads source without running it, DAST exercises the running application, and SCA inventories third-party dependencies for known-vulnerable versions
The OWASP Top 10 is an awareness document you design against; ASVS is a verification standard you test against, and the two are not interchangeable
An event is anything logged, an alert is an event a rule surfaced, and an incident is an alert a human confirmed, so most events never become incidents
Broken object-level authorisation lets a user reach another user's record by changing an identifier; broken function-level authorisation lets a user reach an operation above their privilege

Full stage summary Scenario practice

Stage 3: Operating, regulating and surviving as a security professional

UK and EU cyber regulation mapped

The UK and EU lanes carry their own dates from 2018 to 2028, so an obligation is fixed by jurisdiction and application date rather than by which regime is best known, and a UK operator reading across may be reading law that does not bind it.

NIS2 is EU law and does not bind a UK operator; the UK path is NIS 2018 plus the Cyber Security and Resilience Bill. Obligations turn on jurisdiction, sector, size and date, so the first question is always whether a regime applies and from when. Source: legislation.gov.uk, digital-strategy.ec.europa.eu.

Hold these distinctions

NIS2 is an EU directive and does not apply in the UK; the UK path runs through the NIS Regulations 2018 and the Cyber Security and Resilience Bill, so calling the UK regime NIS2 is wrong
A CVSS score measures how bad a flaw would be if exploited, which is severity; EPSS and the KEV catalogue speak to likelihood and actual exploitation, so severity is not a substitute for likelihood
SIEM collects and correlates logs, SOAR automates response workflows, and XDR unifies detection across endpoints and other telemetry, so they are complementary rather than interchangeable
The recovery time objective is how quickly a service must be restored; the recovery point objective is how much data loss is acceptable, so one is about time and the other about data
IT protects confidentiality first while OT protects safety and availability first, because an OT incident's worst case is physical harm rather than data loss
Direct prompt injection subverts a model through the user's own input; indirect prompt injection arrives inside content the model retrieves, so the trust boundary and the defence differ

Full stage summary Scenario practice

Exam technique for the two papers

The Foundation paper tests precise recall, closed book. Revise the definitions, the current standard versions and dates, and the distinctions above, and in the sitting eliminate the two options that overclaim or say nothing before choosing between the rest. The precise option beats the sweeping one, and the test-wise habit of picking the longest answer is exactly what this bank is written to punish.

The Practitioner paper tests judgement, open book, with four courses of action scored five, three, one and zero. Rank the options rather than hunting one right answer. The strongest option usually addresses the whole threat, not just the visible half: it treats the exfiltration claim as well as the encryption, keeps the regulator's clock running from awareness, and asks for evidence before relying on a claim. The weakest jumps to a control, pays without reasoning, or waits for certainty the situation will never give. Use the reference panel to check, not to read.

Nearly every Practitioner scenario walks the same loop: identify what is at risk, assess how much, treat it, monitor the treatment, and review. When you are torn between two options, place each on the loop; the one that closes the loop, rather than stopping at a single control, is usually the five-point answer.

Risk-to-action loop in five phases with feedback to identification

The dashed arc returns review to identification, which makes the asset inventory and the threat model outputs of each pass rather than fixed inputs. A review that retires nothing has not closed the loop.

Identify, assess, treat, monitor, review, repeat. Every control taught in this course slots into one of these five phases. Source: NIST SP 800-30r1, ISO/IEC 27005.

The official sources behind the course

Version-sensitive claims across the course anchor to primary, dated sources, and every module cites the specific standard it draws on. These are the three entry points worth bookmarking for revision.

NCSC advice and guidance NIST Cyber Security Framework 2.0 ENISA Threat Landscape 2025

When the distinctions hold from memory and the figures feel obvious, you are ready to drill the papers and then sit the mocks.

Start the exam practice Go straight to the mocks