How this course works · meet Scaldimet¶
Your first day¶
It is your first Monday as the Chief Information Security Officer of Scaldimet Industrial Group. Scaldimet has existed for decades. It has never had a CISO before. There is no security team waiting for you, no strategy to inherit, and no budget line with your name on it.
There is, however, a letter. Scaldimet's largest customer (a major car manufacturer) has written to say that, to renew its supply contract, Scaldimet must demonstrate progress on two things: alignment with an international security standard, and readiness for a European cybersecurity law. The contract is worth a large share of Scaldimet's revenue. The deadline is not generous.
You do not yet know where Scaldimet's data lives, who is responsible for the factory systems, or what would happen if a production line stopped. You have a job that did not exist last week, a customer applying pressure, and a law you will need to understand. This course is about how you go from that Monday to a working, defensible security programme (using Governance, Risk and Compliance as your tools).
How the course is built¶
Everything in this course sits in a simple three-level structure.
| Level | What it is | Example |
|---|---|---|
| Module | A major subject area | Module 1 · Concepts |
| Chapter | A topic inside a Module | Chapter 1.3 · What is Risk? |
| Lesson | One ~50-minute learning unit | Lesson 1.3.A |
There are seven Modules, numbered 0 to 6. You are reading the first Lesson of Module 0 now.
Every Lesson follows the same four-part structure, so you always know where you are:
- Hook: a real or realistic situation to ground the idea.
- Concept: the explanation, with clear vocabulary and comparison tables.
- Application: something you work through by hand for Scaldimet.
- Key takeaway: the one idea to keep.
A few principles shape how the course teaches.
Decision tools, not engineering skills. When a technical topic appears, it is explained as something you need to be able to read and discuss with confidence (not something you need to build). These appear in a clearly marked box:
Technical explainer (read & discuss, don't build)
Boxes like this one unpack a technical term for a non-technical reader. You will meet your first real one in Module 1. The goal is always the same: enough understanding to ask good questions and challenge weak answers, not to do the engineering yourself.
Judgement before tools. The core exercises are done by hand or on paper first. A tool can store and speed up a judgement; it cannot make one for you. We build the judgement first.
A real case study, all the way through. You will not jump between disconnected examples. Every Module works on Scaldimet. The same two factories, the same people, the same pressures (seen through governance, then compliance, then risk, and so on). By the end, you will have reasoned through a complete programme for one organisation you understand deeply.
Open and flat. There are no accounts, no payment, and no personalised paths. Everyone sees the same catalogue. You may read any Lesson in any order. We recommend starting at Module 0 and working through Module 1, but nothing stops you jumping ahead.
One ordering choice worth flagging now
Most courses teach Risk before Compliance. This one teaches Compliance before Risk in its operational Modules (3 then 4). There is a deliberate reason for this, and Lesson 1.5 explains it in full. For now: a good compliance baseline already covers most ordinary risk, so it makes sense to put that baseline in place first, then use risk analysis for what the baseline leaves uncovered.
Meet Scaldimet Industrial Group¶
Here is the organisation you have just joined.
The business. Scaldimet manufactures stamped and precision-machined metal parts and assemblies: chassis brackets, engine mounts, transmission housings (supplied directly to large car manufacturers across Europe). It employs around 850 people and earns roughly €140 million a year. It is a mid-sized industrial company: not a tech firm, not a household name, but a critical supplier inside other companies' production lines.
Two factories, deliberately different. Scaldimet runs two sites, and the gap between them will teach you something in every Module.
The two sites
Site Alpha: Belgium (Headquarters). Built relatively recently. Modern and automated: a cloud-hosted ERP system, a Manufacturing Execution System wired into the production line, a network of smart sensors watching the machines for maintenance, normal corporate email and Wi-Fi. Quality-certified to ISO 9001, so the staff are used to documented processes and audits. About 550 employees. Seven of the company's ten IT staff sit here.
Site Beta: France (acquired four years ago). Bought from a previous owner and never fully integrated. Older factory-control systems supervise the machinery (some components are more than fifteen years old and run software that no longer receives security updates). The network is flat: the office computers and the factory machines sit together with nothing separating them. Its staff log in through a completely separate identity system from Alpha. Security habits are weaker, inherited from the previous owner. About 300 employees, with only three IT staff: until recently leaning on an outside contractor.
This is deliberate. The maturity gap between a modern headquarters and an under-resourced acquired site is exactly the situation a real CISO inherits, and we use it on purpose throughout the course.
At both sites, but especially Beta, the engineers who run the factory systems have always reported to the plant manager: not to anyone in IT, and certainly not to a security function that did not exist. They keep production running. Your main governance challenge is not technical; it is establishing authority and accountability over systems whose owners have never had to answer to someone in your role. Hold on to that sentence; Module 2 is largely about it.
Orient yourself¶
Before moving on, do this quickly (on paper or in your head).
You have just read about Scaldimet. Without looking anything up, write down the three things you would want to understand first as its new CISO. Don't aim for "correct" answers; there are none yet. The point is to notice what your instinct reaches for (assets)? the contract? the people? the law? the factory in France you have never visited?
Keep your three. We will come back to them at the end of Module 0, and again much later, and you will be able to see how your thinking has changed.
Key takeaway
This course turns one realistic, messy situation (a first-ever CISO at a mid-sized manufacturer, under customer and legal pressure, with one modern site and one neglected one) into a complete tour of Governance, Risk and Compliance. The structure is Module → Chapter → Lesson; the rhythm is hook → concept → application → takeaway; the principle is judgement before tools; and the thread tying it all together is Scaldimet.