Welcome. This path builds the regulatory and methodological framework of a defensible security programme: not only what NIS2, NIST CSF 2.0, the CIS Controls and ISO/IEC 27001 require, but how they map to one another and how they become evidence that stands up in front of an auditor. The underlying idea is that compliance is not a formality to be added to security, but the way of demonstrating it.

Path objectives

By the end of the path you will be able to:

• establish whether and how your organisation falls under NIS2 and with which obligations (Modules 1 and 2)
• use the NIST Cybersecurity Framework 2.0 as the lingua franca of the security programme (Module 3)
• apply the CIS Controls v8.1 as a prioritised implementation route (Module 4)
• understand how an ISO/IEC 27001:2022 management system works and what a certification body looks at (Module 5)
• build an integrated programme with cross-mappings, avoiding doing the same work four times (Module 6)
• prepare for and undergo an audit: evidence, non-conformities, continual improvement (Module 7)
• implementing and governing the ACN basic specifications that apply to your entity qualification, with the evidence that demonstrates them and the deadlines that order them (Module 8)

Who it is for and prerequisites

IT and security managers, compliance managers, DPOs, internal auditors and anyone who has to answer security questionnaires from customers and lead firms. It is advisable to have taken the paths on fundamentals and on hygiene first: this path takes the concepts of risk, threat and control as given.

How it runs

The path runs entirely online, in asynchronous mode: you can study whenever you want, at your own pace, from any device. The total estimated duration is 35 hours, to be spread out within the completion deadline given further on.

Each module is organised into four lessons and two tests:

1. Lesson. A reasoned treatment of the topic, with diagrams, examples and concrete cases.
2. In depth. The updated regulatory and technical framework, with the deadlines that matter and references you can check at source.
3. Real-world cases. What really happens in the market: documented episodes always read with the same grid, down to the control that would have broken the chain.
4. In practice. What you do on Monday morning: procedures, checklists, ready-made templates and indicators to measure the result.
5. Test. Closed answer questions on the whole module. Passing requires at least 70%; attempts are unlimited and the best mark counts. At the end of each attempt you get a precise explanation of every answer, including the correct ones.
6. Exercise. A case to work through by deciding: every choice opens a different path and the outcome depends on what you chose, with an explanation of what would have happened otherwise. Marking is automatic and you can retake it as many times as you like.

Progression. The 8 modules are worked through in sequence: each module unlocks only after passing the previous module's test. The exercises don't block progress, but they are an integral part of the path and of the overall assessment.

Final test and certificate

Once you have passed the tests of all the modules, the final test is unlocked: 30 questions drawn at random from the topics of the whole path, with the same 70% threshold and unlimited attempts. On passing you obtain the path certificate, downloadable as a PDF, with a unique code that allows its authenticity to be verified.

Warning

The contents are up to date as at August 2026, are for training purposes and do not constitute legal advice. For the obligations that fall on your organisation always refer to the legislation in force and to internal legal support.

Support

In the Announcements forum you will find messages from the tutor. For questions about the content or the exercises, use the channels indicated by your training contact.