IIBA CCA study plan

Map the full Cybersecurity Analysis domain into a personal outline covering business analysis fundamentals applied to security contexts, stakeholder identification, and requirements lifecycle, and locate every concept you cannot yet explain in one sentence

Define cybersecurity analysis terminology in your own words: threat, vulnerability, risk, control, exposure, likelihood, impact, and residual risk, and distinguish each pair that you tend to conflate

Identify the key stakeholder groups a cybersecurity analyst serves (business owners, IT operations, risk and compliance, legal, auditors, incident responders) and write the decision each group needs from analysis

Build a personal glossary of at least 40 terms with a one-line definition and one example each, flagging any term you cannot yet example

Explain how cybersecurity analysis fits the broader business analysis framework: elicitation, analysis, requirements specification, validation, and traceability, and describe what changes when the subject is a security control rather than a business feature

Practice elicitation by drafting 15 open-ended questions you would ask a system owner before assessing a new internet-facing application

Distinguish functional, non-functional, and security requirements, and rewrite five vague security wishes into testable requirement statements with measurable criteria

Classify at least ten security requirements by control family (access control, cryptography, logging, resilience, and similar) and justify each placement

Apply risk analysis end to end: build a risk register with asset, threat, vulnerability, likelihood, impact, inherent risk score, proposed treatment, and residual risk for a fictional mid-size organization

Compare qualitative, semi-quantitative, and quantitative scoring approaches and state which you would defend to a business sponsor and why

Select treatment options (mitigate, transfer, avoid, accept) for each register entry and justify the choice against cost and business impact

Trace each treatment back to a security requirement and forward to a validation method, so the register is auditable

Analyze an organization's security posture by mapping its controls against a recognized framework structure, and identify gaps without copying framework text verbatim

Translate a control gap into a business-impact statement that a non-technical executive can act on

Evaluate third-party and supply-chain risk by drafting the due-diligence questions you would ask a vendor handling sensitive data

Rehearse explaining a single high-severity finding three ways: to an engineer, to a risk committee, and to a customer-facing manager

Analyze data protection and privacy obligations by identifying what data the organization holds, where it flows, and which controls protect it at rest, in transit, and in use

Draft a data flow description for one business process and mark each point where sensitive data crosses a trust boundary

Specify logging, monitoring, and detection requirements that would let an analyst reconstruct a security event after the fact

Identify at least five ways an analysis can be technically correct but operationally unusable, and propose a fix for each

Analyze incident and response readiness by defining what analysis artifacts responders need before, during, and after an incident

Write the analysis inputs for a tabletop exercise: scenario, affected assets, decision points, and the questions the analyst must answer under time pressure

Evaluate business continuity and recovery expectations by distinguishing recovery time and recovery point objectives and stating how each drives a requirement

Assess communication and escalation paths and identify where analysis handoffs are most likely to lose critical context

Integrate all prior work into a single end-to-end case: one fictional organization, one risk assessment, one requirements set, one control mapping, and one validation plan

Validate the case by tracing every requirement back to a risk and every risk forward to a control or accepted decision, and repair any orphaned item

Draft a concise analysis report structure with executive summary, scope, method, findings, recommendations, and limitations

Self-test with 40 original practice questions you write yourself across the domain, then explain each answer aloud without notes

Consolidate weak areas identified in week 7 by rewriting your glossary entries and requirement statements for every concept you still cannot explain cleanly

Rehearse the analyst's communication deliverables by presenting the case study findings in a ten-minute spoken summary recorded and reviewed against your own checklist

Review the full domain outline and glossary one final pass, marking each item as solid, shaky, or unknown, and schedule targeted review for the shaky items

Confirm exam-day logistics and build a final one-page reference sheet of decision rules you keep forgetting