Data Security and Information Protection

Programme Summary

Protect business information through proportionate controls across creation, storage, sharing and disposal. Participants connect information classification with access, encryption, monitoring and recovery arrangements, while considering human behaviour and supplier interfaces. A practical business case develops a control plan and response priorities, helping teams reduce avoidable exposure and maintain usable evidence that sensitive information is handled appropriately.

Training Objectives

1 Connect information protection with business exposure; 2 Strengthen classification and access control decisions; 3 Improve secure handling throughout the data lifecycle; 4 Coordinate technical human and supplier safeguards; 5 Support monitoring and response to information exposure.

Learning Outcomes

1 Classify information using agreed business criteria; 2 Map sensitive data flows and control gaps; 3 Select justified access encryption and sharing safeguards; 4 Define monitoring recovery and incident escalation needs; 5 Prepare an actionable information protection control plan.

Target Audience

Information Security Officers; Data Protection Coordinators; IT Managers; Information Asset Owners; Data Governance Officers; Compliance Managers.

Target Industries

Financial Services; Healthcare Services; Professional Services; Telecommunications; E Commerce; Public Services.

Course Contents

• Module 1 Information Protection and Business Context: Confidentiality integrity and availability needs; Data assets owners and exposure scenarios; Proportionate controls and business usability.
• Module 2 Information Inventory and Classification: Identify sensitive and critical information; Classification criteria labels and handling rules; Ownership review and changing sensitivity.
• Module 3 Data Flows and Exposure Points: Map storage processing and transfer locations; External sharing and supplier access interfaces; Unmanaged copies devices and shadow services.
• Module 4 Identity and Access Controls: Least privilege and role based permissions; Strong authentication and privileged access oversight; Joiner mover leaver and access reviews.
• Module 5 Encryption and Key Management Concepts: Protection in transit and at rest; Key ownership access rotation and recovery; Encryption limits and implementation dependencies.
• Module 6 Secure Storage and Collaboration: Approved repositories and sharing permissions; Link access expiry and recipient verification; Version integrity and controlled collaboration practices.
• Module 7 Data Loss Prevention and Monitoring: Define sensitive information detection objectives; Evaluate alerts exceptions and false positives; Align monitoring with privacy and workforce policies.
• Module 8 Endpoint and Remote Working Controls: Device security and removable media risks; Remote access and secure working practices; Protect information outside controlled office environments.
• Module 9 Retention Disposal and Supplier Interfaces: Approved retention and defensible disposal; Supplier safeguards and return or deletion evidence; Data minimisation and lifecycle review triggers.
• Module 10 Backup Integrity and Recovery: Recovery needs and protected backup copies; Restoration testing and evidence of usability; Access controls against destructive changes.
• Module 11 Information Exposure Response: Recognise suspected loss or unauthorised disclosure; Contain exposure and preserve relevant evidence; Escalate reporting and recovery decisions.
• Module 12 Information Protection Case: Assess a fictional sensitive data workflow; Select controls and document implementation ownership; Present monitoring and response priorities.

Assessment

• 60 single best answer questions, including applied scenarios; one mark per question.
• 90 minute invigilated digital examination with identity verification. Approved accessibility adjustments preserve the assessed competence.
• Supplied reference sheets permitted; external AI, messaging and unapproved internet assistance prohibited.
• Individual applied assessment (45 minutes): Assess a sensitive information workflow, classify its data, identify exposure points and produce a prioritised control plan covering access, sharing, monitoring, recovery and escalation.
• Assessment criteria: Accurate classification and exposure analysis; Proportionate complementary protection measures; Clear ownership monitoring and response arrangements.
• Pass each component separately: 45/60 written marks (75%) and at least 70% on the applied task.
• All mandatory criteria must pass: Do not expose real confidential or personal data during learning activities.
• Individual results and feedback are provided. One reassessment may follow coaching under the published enrolment terms.

Certification

• Successful learners receive a TQCSI Arabia digital Certificate of Successful Completion.
• The certificate records the learner name, exact programme title, teaching hours, completion date and unique verification reference.
• Verified identity, full attendance and separate written and applied passes are required; all mandatory critical criteria must be met.
• Proposed issue target: within 30 calendar days of approved results and settlement of applicable fees.
• Records assessed information protection skills; it does not authorise production security changes or independently certify organisational data security.
• Attendance confirmation may record completed hours for unsuccessful learners; it does not certify successful completion.

Programme Profile

Number of daysNumber of daysNumber of days

333

Total teaching hoursTotal teaching hoursTotal teaching hours

18 hours; breaks, pre course work and formal final assessments excluded.18 hours; breaks, pre course work and formal final assessments excluded.18 hours; breaks, pre course work and formal final assessments excluded.

Delegates allowedDelegates allowedDelegates allowed

Maximum 20 delegates.Maximum 20 delegates.Maximum 20 delegates.

Training prerequisitesTraining prerequisitesTraining prerequisites

Basic understanding of business information systems and security concepts is recommended. Network administration or programming experience is not required.Basic understanding of business information systems and security concepts is recommended. Network administration or programming experience is not required.Basic understanding of business information systems and security concepts is recommended. Network administration or programming experience is not required.

Pre course assignment and assessmentPre course assignment and assessmentPre course assignment and assessment

Review a fictional information inventory and sharing scenario; complete a 30 minute classification and access diagnostic.Review a fictional information inventory and sharing scenario; complete a 30 minute classification and access diagnostic.Review a fictional information inventory and sharing scenario; complete a 30 minute classification and access diagnostic.

End of course assessmentEnd of course assessmentEnd of course assessment

60 question written exam (90 minutes) and individual applied task (45 minutes).60 question written exam (90 minutes) and individual applied task (45 minutes).60 question written exam (90 minutes) and individual applied task (45 minutes).

Passing criteriaPassing criteriaPassing criteria

75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.