Certification standard
Mobilize your teams to protect against cybersecurity risks
Competency framework
1. Identify the company's key assets in order to target the priority actions to be taken to protect them from the consequences of cyber malicious acts (theft, exfiltration, destruction)
2. Identify and assess the risks of cyber malicious acts that may target the company in order to implement the appropriate protection systems
3. Understand the techniques used by cyber-malicious adversaries to better organize the protection of the organization
4. Deploy a strategy to adopt good IT hygiene and vigilance practices in order to avoid the triggering of cyber-malicious acts
5. Conduct a business continuity strategy to minimize the financial impact and ensure the economic survival of the company in case of an attack
6. Manage internal and external teams and stakeholders during a cyber crisis to restore operations and ensure economic survival
7. Engage teams on cyber security issues by using managerial and cultural levers to prevent cyber risks
8. Understand the legal framework by mastering the legal conventions and identifying the key actors in charge of cyber security to ensure an appropriate response after an attack
Evaluation methods
All certification tests take place at the end of the training.
Written case study (10mn)
- Individual written case study, the candidate answers an open-ended question to identify the key assets and sensitive data to be protected
Written case study (20mn).
- Individual written case study, in which a situation is described. The candidate answers an open question to identify the risks of the fictitious company and recommends solutions.
A multiple-choice questionnaire on knowledge (duration 15min)
The questionnaire is accessible via a secure LMS platform. It can also be printed and administered live. 60% correct answers are required to validate the quiz. The quiz also validates competency 8
Written case study (20mn).
- Individual written case study, in which a situation is described. Based on the analysis of key assets and cyber risks, the candidate develops a protection and vigilance strategy for employees
Written case study (15mn).
- Individual written case study, in which a situation is described. The candidate recommends a business continuity strategy in order to maintain the activity in case of cyber-attack or failure of a service provider
Written case study (15mn).
- Individual written case study in which a cyber crisis situation is described. The candidate describes by answering open-ended questions how he/she will react, what actions to take, who to contact and what communication to adapt.
Oral case study.
-The participant accesses the context of the situation on the secure LMS platform and then records himself by transmitting a motivational message. He then transmits the audio files to the evaluator.
- A multiple-choice questionnaire on knowledge (duration 15min)
The questionnaire is accessible via a secure LMS platform. It can also be printed and administered live. 60% correct answers are required to validate the quiz. The quiz also validates competency 3
Evaluation criteria
Key assets to be protected have been clearly identified
Sensitive customer and employee data has been clearly identified
The company's risks with regard to cyber malicious acts are clearly identified
Potential human and technical vulnerabilities in the company are detected
The technological framework of the company and the IT architecture is taken into account in the recommendations
The techniques of the cyber malicious actors are well identified
Exchanges with cyber criminals during an attack comply with official recommendations
The described protection strategy is effective and allows reducing cyber risks in the company
The best practices to be adopted by the teams are precisely formulated
The communication to the teams is described in detail and allows a quick implementation
The continuity strategy proposes an alternative way of operating without digital tools or with alternative tools
The actors and the steps for implementing the strategy are clearly identified
The situation is analyzed and the available information is verified
The actions are distributed among the different internal actors (technical and operational teams, etc.)
The actions recommended by the candidate allow to reduce the propagation of the malware/ransomware
The actions recommended by the candidate will reduce the economic impact of the attack
The candidate proposes an adequate internal and external communication
The candidate communicates on the cybersecurity issues and the risks incurred by the company
The candidate uses examples and stories to reinforce the message
The actors in charge of cyber security and the regulatory actors are known and defined
The methodology for referencing and declaring to the public actors in charge of cyber security, in case of a cyber attack
is known and defined
Each of the rights to be respected in order to be in compliance with the data protection legislation is known and defined
