Skip to content
- Information Security FundamentalsLearn the fundamentals of information security, including key principles, the seven elements of information security, and information asset management.
- Information Security Governance and DocumentationUnderstand information security governance and learn how to develop, structure, and maintain security policies, rules, standards, guidelines, and related documentation.
- Information Security Laws and ComplianceExplore information security laws and compliance requirements, including personal data protection, outsourcing management, and third-party risk management.
- Security Standards and GuidelinesExplore information security standards, frameworks, and guidelines, including ISO/IEC 27001, NIST CSF, and CIS Controls, with practical guidance on their use.
- Security TechnologiesLearn about security technologies and concepts, including passkeys, hashing, encryption, and defense in depth, with clear explanations of how they work.
- Identity and Access Management (IAM)Learn the fundamentals and practices of identity and access management, including authentication, authorization, SSO, account provisioning, and access control.
- Zero TrustExplore Zero Trust principles, NIST SP 800-207, Forrester ZTX, SASE, and SSE, including the architectures and technologies used to implement Zero Trust security.
- SSO vs. Account Provisioning: Key DifferencesCompare SSO and account provisioning, understand JIT and the roles of SAML, OIDC, and SCIM, and plan joiner, mover, and leaver processes.
- What Is Single Sign-On (SSO)?Learn how SSO works through SAML and OpenID Connect, how IdPs and applications establish trust, and what to check for MFA, sessions, outages, and offboarding.
- What Is Account Provisioning? SCIM and ImplementationUnderstand SCIM users, groups, and identifiers, then add provisioning to existing SSO with account matching, data-retention checks, a staged rollout, and troubleshooting.
- What Is Information Security? Importance, Threats, and Basic PracticesUnderstand information security, its relationship with cybersecurity, common threats, and seven basic practices. Learn where to start protecting information and business operations.
- The Seven Elements of Information Security: The CIA Triad and Four Additional PropertiesA practical guide to the CIA triad—Confidentiality, Integrity, and Availability—and the four additional security properties of Authenticity, Accountability, Non-repudiation, and Reliability, with concrete controls for each.
- Information Asset Registers: Fields, IT Asset Inventories, and Risk AssessmentLearn what an information asset register contains, how it differs from an IT asset inventory, and how to use it to assess risks and maintain effective security controls.
- What Is Information Security Governance?Understand governance, management, responsibilities, necessary documents, oversight metrics, and a practical implementation sequence.
- Comparing Policies, Rules, Standards, and GuidelinesCompare document purposes, authority, specificity, and approvals, and see how the same control is expressed at each level.
- Information Security PolicyLearn the essential policy sections, leadership commitments, publication choices, and a practical template linked to operational evidence.
- Information Security Management RulesCreate internal rules with clear responsibilities, approvals, obligations, exception handling, reporting, and practical sample clauses.
- Information Security StandardsWrite verifiable requirements for classification, authentication, endpoints, vulnerabilities, logging, recovery, and compliance tracking.
- Information Security GuidelinesSupport everyday decisions with clearly separated mandatory rules and recommendations for messaging, cloud, generative AI, and remote work.
- Security Procedures, Records, and RegistersTurn rules into executable procedures and traceable evidence, with onboarding, incident-response, and asset/risk/exception register examples.
- Creating, Approving, and Reviewing Security DocumentsManage documents from drafting and approval through communication, operation, review, revision, and withdrawal, with practical planning examples.
- IT Outsourcing Management and Third-Party Risk Management (TPRM) ExplainedUnderstand IT outsourcing providers, how outsourcing management differs from third-party risk management (TPRM), relevant regulations and standards, and practical steps for assessment, contracts, monitoring, and exit planning.
- IPA's Six Essential Information Security Practices — A Starting Point for SMEsA practical guide to IPA's six essential information security practices, including detailed actions, risks of inaction, and implementation checklists for small and medium-sized enterprises.
- A Practical Guide to IPA's Information Security Guidelines for SMEsWhat the Japanese guideline covers and how a small business can put it into practice
- What Are the CIS Controls? The 18 Controls and How to Get StartedAn introduction to CIS Controls v8.1: its purpose, 18 Controls, 153 Safeguards, Implementation Groups IG1–IG3, and a practical approach to adoption.
- NIST Cybersecurity Framework (CSF) 2.0: Six Functions and Practical ImplementationA practical guide to NIST CSF 2.0 covering Govern, Identify, Protect, Detect, Respond, and Recover, with policies, technology choices, operational activities, Profiles, and Tiers.
- Cybersecurity Management Guidelines: Three Principles and Ten Key ActionsA practical overview of Japan’s METI and IPA Cybersecurity Management Guidelines Ver3.0, covering executive accountability, three principles, and ten key management actions.
- ISO/IEC 27001 vs. ISO/IEC 27002: ISMS, Annex A, and Security Controls ExplainedLearn how ISO/IEC 27001 and ISO/IEC 27002 differ, how ISMS certification works, what Annex A's 93 controls mean, and how to implement risk-based security controls.
- Japan FSA Cybersecurity Guidelines for the Financial Sector: An Actionable SummaryA practical English guide to the Japan FSA's financial-sector cybersecurity expectations, covering governance, risk identification, protection, detection, response, recovery, and third parties.
- Lessons from Ransomware Incidents: What Leaders and Response Teams Should PrepareSummarizes lessons from ransomware incidents, including executive decisions, role sharing, business continuity, incident response, and recovery preparation.
- Defense in Depth in Cybersecurity: Ingress, Internal, and Egress SecurityLearn how defense in depth works, common attacks at the network entry, internal, and outbound stages, and practical security controls to prevent intrusions, lateral movement, and data exfiltration.
- What Are Passkeys? How They Work, Where They Live, and How You Unlock ThemUnderstand passkeys, how they differ from passwords, and the role of PINs, fingerprints, and face recognition. Learn about device-bound and synced passkeys, storage providers, and key limitations.
- Email Security: How SPF, DKIM, and DMARC Work and How to Configure ThemLearn what SPF, DKIM, and DMARC authenticate, how to publish their DNS records, how domain alignment works, and how to verify results in received messages.
- Hashing vs. Encryption: Differences, Use Cases, Standards, and SecurityLearn how hashing differs from encryption, when to use each, common algorithms and standards, and security practices for passwords, file integrity, TLS, and encryption keys.
- What Is Zero Trust? Why It Matters and How to Get StartedUnderstand zero trust, how it differs from perimeter security, why organizations need it, its benefits and trade-offs, and a practical approach to gradual adoption.
- NIST SP 800-207: Seven Zero Trust Tenets and ArchitectureAn accessible guide to NIST SP 800-207, covering its seven zero trust tenets, PE, PA, and PEP components, deployment approaches, remaining risks, and a practical migration roadmap.
- Forrester ZTX Explained: Seven Domains for Implementing Zero TrustUnderstand Forrester's Zero Trust eXtended (ZTX) Ecosystem, with practical controls for its seven domains, additional platform evaluation criteria, and a phased implementation approach.
- SASE vs. SSE: Definitions, Architecture, and Key DifferencesLearn what SASE and SSE mean, how SWG, CASB, ZTNA, and SD-WAN fit together, and when to adopt SSE or a broader SASE architecture.
- Leading SASE and SSE Vendors and Products ComparedCompare SASE/SSE products, capability mappings, architectural approaches, and evaluation considerations for Zscaler, Netskope, Palo Alto Networks, Cloudflare, Cisco, Cato Networks, and Microsoft.