CCPC study plan
CCPC · Give each week a clear focus.
8 weeks · About 7 hours per week
Cyber Policy Fundamentals and Governance & Cybersecurity Risk Management and Frameworks
Map every sub-topic in Domains 1 and 2 to a one-line definition in your own words
Distinguish policy, governance, and risk-management concepts by writing a comparison table of at least 10 paired terms
Identify the governing bodies and standard-setting organizations referenced in each domain and note their roles
Draft a personal glossary of 25 core terms with citations to authoritative public sources
Your checkpoint
A 25-term glossary plus a 10-row concept comparison table covering Domains 1 and 2
Cybersecurity Risk Management and Frameworks
Walk through a generic risk-assessment lifecycle from asset identification to treatment selection
Classify 15 sample risks by likelihood and impact and justify each rating in one sentence
Compare at least three widely used risk frameworks on scope, structure, and output artifacts
Explain how risk appetite and tolerance statements drive control selection
Your checkpoint
A completed 15-risk register with ratings, justifications, and a one-page framework comparison
Legal, Regulatory, and Compliance Environment & Cyber Policy Fundamentals and Governance
Differentiate statutory, regulatory, and contractual obligations using concrete examples
Trace how a governance structure translates legal obligations into internal policy
Outline the compliance lifecycle from obligation identification through audit and remediation
Summarize the roles of regulators, auditors, and internal compliance functions
Your checkpoint
A two-page compliance lifecycle diagram with an accompanying obligation-to-policy mapping for three example obligations
Incident Response, Resilience, and Business Continuity Policy & Legal, Regulatory, and Compliance Environment
Sequence the phases of an incident-response lifecycle and state the policy decision made at each phase
Distinguish business continuity, disaster recovery, and resilience objectives and metrics
Draft escalation and notification triggers that connect incident severity to legal reporting duties
Identify which policy artifacts must exist before an incident occurs
Your checkpoint
A one-page incident escalation matrix linking three severity tiers to notification obligations and policy owners
Data Privacy, Protection, and Cross-Border Data Policy
Define core privacy principles and map each to a corresponding organizational control
Compare major privacy regulatory models on scope, lawful basis, and individual rights
Explain cross-border transfer mechanisms and the policy tradeoffs each creates
Analyze a data-flow scenario and identify where transfer restrictions apply
Your checkpoint
A data-flow case analysis identifying three transfer mechanisms, their conditions, and residual policy risks
Public-Private Partnerships and Information Sharing & Cyber Diplomacy, International Norms, and Deterrence
Describe how public-private partnerships are structured and what each party contributes
Explain the purpose and mechanics of information-sharing arrangements and their legal limits
Summarize the role of international norms in shaping state behavior in cyberspace
Differentiate deterrence approaches and the policy assumptions behind each
Your checkpoint
A two-page briefing note comparing information-sharing incentives with international norm adherence, including three policy tensions
Emerging Technology Policy (AI, Cloud, IoT, Supply Chain) & Data Privacy, Protection, and Cross-Border Data Policy
Assess policy implications of AI, cloud, IoT, and supply-chain risk across a common evaluation rubric
Identify where existing privacy and governance policy gaps emerge for emerging technologies
Evaluate supply-chain risk-management expectations from a policy rather than technical lens
Propose two policy controls for one emerging-technology scenario and justify each
Your checkpoint
A technology-policy assessment matrix covering four technologies against five policy criteria, with two justified control recommendations
Cyber Policy Fundamentals and Governance & Cybersecurity Risk Management and Frameworks & Legal, Regulatory, and Compliance Environment & Incident Response, Resilience, and Business Continuity Policy & Data Privacy, Protection, and Cross-Border Data Policy & Public-Private Partnerships and Information Sharing & Cyber Diplomacy, International Norms, and Deterrence & Emerging Technology Policy (AI, Cloud, IoT, Supply Chain)
Reconcile all weekly deliverables into a single indexed study portfolio
Self-test across every domain and log weak areas with corrective actions
Rehearse articulating cross-domain linkages such as privacy obligations feeding incident notification policy
Finalize a one-page quick-reference sheet of core definitions and frameworks
Your checkpoint
A complete indexed portfolio plus a scored self-assessment log identifying three weak domains and remediation steps
Milestones
Week 2: Can define all Domain 1 and 2 core terms from memory and explain the risk lifecycle end to end without notes
Week 4: Can trace a single incident scenario from detection through legal notification using only your own policy artifacts
Week 6: Can explain cross-border transfer restrictions and information-sharing limits in plain language to a non-specialist
Week 8: Portfolio complete, self-assessment scored, and all three identified weak domains have a written remediation plan