GSTP study plan

Map the security transformation lifecycle (assess, design, execute, sustain) and write a one-page summary in your own words

Distinguish governance structures (board, steering committee, security council) and record who owns which decision rights

Draft a RACI for a transformation program covering executives, security, IT, and business units

List the regulatory and contractual drivers that force security change in your industry and cite two you can defend

Build a business-case template that ties a security initiative to revenue, cost, or risk reduction

Practice translating technical risk into financial terms using a worked example

Compare build, buy, and managed-service options for a transformation initiative and justify one

Identify three stakeholder personas and write the key message each needs to hear

Apply a risk assessment method (qualitative and quantitative) to a sample scenario end to end

Construct a risk register with likelihood, impact, owner, treatment, and residual rating

Distinguish risk appetite from risk tolerance and write both as statements leadership could approve

Select treatment options (mitigate, transfer, avoid, accept) and justify each choice

Derive a control set from a chosen framework and map each control to a risk in your register

Design a tiered security program structure (policy, standard, procedure) and show how they connect

Sequence program initiatives by risk reduction per unit of effort and defend the ordering

Define exception and risk-acceptance workflows with escalation thresholds

Diagram a target-state security architecture showing trust boundaries and control points

Explain zero-trust principles and describe where they change an existing network design

Compare identity, data protection, and detection technology options against defined requirements

Identify integration and migration risks for one major technology change and list mitigations

Write migration and cutover criteria for moving from current to target architecture

Define the operating model change (roles, processes, tooling) required to run the new architecture

Draft a change-communication plan naming audiences, channels, and cadence

Anticipate resistance points and prepare responses for the two most likely objections

Select security metrics that measure outcomes rather than activity and define how each is calculated

Build a one-page executive dashboard mockup with trend context and thresholds

Design an incident and operations rhythm (review cadence, escalation, post-incident learning)

Practice a five-minute verbal briefing that reports status, risk, and the ask to an executive

Rehearse scenario-based questions across all four domains and log weak spots

Review every deliverable and correct gaps in governance, risk, architecture, or metrics logic

Memorize the decision frameworks you will reuse under time pressure

Run a timed full-length practice set and analyze error patterns by domain