Module 2 · Governance

This is the first operational Module: where you stop defining ideas and start running Scaldimet. In Module 1 you learned that governance directs security and holds people accountable, and you saw Scaldimet's governance gap at close range. Now you build the layer that closes it.

The course's operational order is governance first, then compliance, then risk. There is a reason governance leads: a control baseline (Module 3) and a risk assessment (Module 4) are worth little if no one has the authority to require them, no one owns the systems they apply to, and no one oversees whether anything changes. Governance is the ground the rest stands on.

The Module is deliberately low on technology. Almost every move is a decision, a document, a structure or a named owner. You begin at the top (a strategy aligned to the business), establish your role and its limits, set direction through policy, build the structures and reporting that make it run, and finish with the hardest part of all: the culture without which the rest stays on paper.

What you will be able to do

• Write a security strategy that is aligned to Scaldimet's business objectives, not a shopping list of controls.
• Locate the cyber-GRC role using the three-lines model, and define where your oversight ends and operational governance begins.
• Build a coherent policy architecture, and write and govern a policy through its lifecycle, including exceptions.
• Stand up the structures (committees, RACI, ownership) and the reporting machinery (KPIs, KRIs, board packs) that keep governance alive.
• Plan the cultural and organisational change that turns governance on paper into governance in practice.

Chapters in this Module

Chapter	Title	Lessons
2.1	Security Strategy & Business Alignment	1
2.2	The GRC Role & Mandate	2
2.3	Policy & Document Architecture	2
2.4	Governance Structures	1
2.5	KPIs, KRIs & Reporting to the executive and board	1
2.6	Security Culture & Organisational Change	1

---

Begin Chapter 2.1 →