[major=IA | course_id=IAA202 | syllabus_id=13276 | semester=5 | combo=core | title=Risk Management in Information Systems]
Course ID: IAA202
Title EN: Risk Management in Information Systems
Title VI: Quản trị rủi ro trong hệ thống thông tin
Credits: 3.0
Prerequisites: IAO101 or IAO201c or IAO202
Description: The course provides a comprehensive view of managing risk in information systems.
It covers the fundamentals of risk and risk management and also includes in-depth details on more comprehensive risk management topics.
Areas of instruction include how to assess and manage risk based on defining an acceptable level of risk for information systems. Elements of a business impact analysis (BIA), business continuity plan (BCP), disaster recovery plan (DRP) and computer incident response team (CIRT) plan are also discussed.
Student tasks: - Students must attend at least 80% of contact sessions in order to be accepted to the final examination.
- Students are responsible to do all exercises, assignments and labs given by instructor in class or at home and submit in time
- Use laptop in class only for learning purpose
- Promptly access at https://flm.fpt.edu.vn/ for up-to-date course information
Tools: Internet, Student VM workstation with Microsoft Office 2007 or higher, Zenmap, Nessus, AI Tools: ChatGPT, Gemini, Copilot,…
Course type: traditional
Decision: 932/QĐ-ĐHFPT dated 08/22/2025
Approved date: 2025-08-22
CLO1: Understand the fundamental concepts of risk management and its importance.
[1] category=Assessment 1; type=on-going; weight=10.0; duration=Option 1: 45'/team; Option 2 (For Constructivism Approach only): Follow lecturer's proposal; question_type=CLO1, CLO2, CLO3, CLO4, CLO5; grading_guide=Cover Lectures 1- 5; completion_criteria=; clos=>0
[2] category=Assessment 2; type=on-going; weight=15.0; duration=Option 1: 45'/team; Option 2 (For Constructivism Approach only): Follow lecturer's proposal; question_type=CLO6, CLO7, CLO8, CLO9, CLO10; grading_guide=Cover Lectures 6- 10; completion_criteria=; clos=>0
[3] category=Assessment 3; type=on-going; weight=15.0; duration=Option 1: 45'/team; Option 2 (For Constructivism Approach only): Follow lecturer's proposal; question_type=CLO11, CLO12, CLO13, CLO14, CLO15; grading_guide=Cover Lectures 11- 15; completion_criteria=; clos=>0
[4] category=Final Project Presentation; type=on-going; weight=20.0; duration=45'/each; question_type=CLO1, CLO2, CLO3, CLO4, CLO5,CLO6, CLO7, CLO8, CLO9, CLO10,CLO11, CLO12, CLO13, CLO14, CLO15; grading_guide=; completion_criteria=; clos=>0
[5] category=Midterm Test; type=on-going; weight=20.0; duration=Option 1: 30'- 40’ Option 2 (For Constructivism Approach only): Follow lecturer's proposal; question_type=; grading_guide=Cover Lectures 1- 8; completion_criteria=; clos=>0
[6] category=Final Exam; type=Final exam; weight=20.0; duration=60'; question_type=; grading_guide=concepts, algorithms; all studied Chapters; completion_criteria=; clos=4
[1] desc=Computer Security Handbook; author=Seymour Bosworth, M.E. Kabay, Eric Whyne; publisher=John Wiley & Sons; edition=6th; isbn=; main=; online=; note=
[2] desc=Information Security Management Metrics: A Definitive Guide to Effective Security Monitoring and Measurement; author=W. Krag Brotby; publisher=CRC Press; edition=; isbn=; main=; online=; note=
[3] desc=Information Security Risk Analysis; author=Thomas R. Peltier; publisher=CRC Press; edition=3rd; isbn=; main=; online=; note=
[4] desc=Lecture slides, Lab manual, supplementary material; author=; publisher=; edition=; isbn=; main=; online=; note=
[5] desc=Managing Risk In Information Systems; author=Darril Gibson; publisher=Jones & Bartlett Learning; edition=2nd; isbn=978-1284055955; main=True; online=True; note=Books24x7, https://library.books24x7.com/toc.aspx?bookid=69822
[6] desc=Measuring and Managing Information Risk: A FAIR Approach; author=Jack Freund, Jack Jones; publisher=Butterworth-Heinemann, Elsevier; edition=; isbn=; main=; online=; note=
[7] desc=Security Controls Evaluation, Testing, and Assessment Handbook; author=Leighton R. Johnson; publisher=Syngress; edition=; isbn=; main=; online=; note=
Session 1: Lecture 1. Risk Management Fundamentals
1.1 The Major Components of Risk to an IT Infrastructure
1.2 Risk Management and Its Importance to the Organization
Topic: Offline; Teaching type: CLO1; LO: T
ITU: Read Chapter 1
Download: Study and Review Lecture 1

Session 2: Lecture 1. Risk Management Fundamentals
1.3 Risk Identification Techniques
1.4 Risk Management Techniques
Topic: Offline; Teaching type: CLO1; LO: T
ITU: Read Chapter 2
Download: Study and Review Lecture 1

Session 3: Project Kick-off & Team Formation:
Introduce project requirements, deliverables, and grading rubric.
Form student teams (3–5 members).
Brainstorm possible project topics (e.g., risk analysis for a healthcare IT system, vulnerability assessment in cloud environments).

Use AI brainstorming: students ask AI to suggest 5–10 possible topics → select one with instructor approval.
Topic: Offline; Teaching type: CLO1; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 4: Guide: How to Identify Threats and Vulnerabilities in an IT Infrastructure
Topic: Offline; Teaching type: CLO1; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students
CLO10: Describe the process of planning risk mitigation throughout an organization.
Session 1: Lecture 2. Managing Risk: Threats, Vulnerabilities, and Exploits
2.1 Understanding and Managing Threats
2.2 Understanding and Managing Vulnerabilities
Topic: Offline; Teaching type: CLO2; LO: T
ITU: Read Chapter 2
Download: Study and Review Lecture 2

Session 2: Lecture 2. Managing Risk (cont): Threats, Vulnerabilities, and Exploits
2.1 Understanding and Managing Threats
2.2 Understanding and Managing Vulnerabilities
Topic: Offline; Teaching type: CLO2; LO: T
ITU: Read Chapter 2
Download: Study and Review Lecture 2

Session 3: Lecture 3. Maintaining Compliance
3.1 Regulations Related to Compliance
3.2 Organizational Policies for Compliance
Topic: Offline; Teaching type: CLO3; LO: T
ITU: Read Chapter 3
Download: Study and Review Lecture 3

Session 4: Lecture 3. Maintaining Compliance
3.3 Standards and Guidelines for Compliance
Topic: Offline; Teaching type: CLO3; LO: T
ITU: Read Chapter 3
Download: Study and Review Lecture 3
CLO11: Describe the process of implementing a risk mitigation plan.
Session 1: Project Proposal Submission:
Teams submit a 1-2 page proposal outlining their chosen enterprise, scope, and initial risk hypotheses.
AI can assist in structuring the proposal, but students must critically refine it.
Instructor + peers provide feedback
Topic: Offline; Teaching type: CLO3; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 2: Guide: Align Risks, Threats and Vulnerabilities to COBIT P09 Risk Management Controls
Topic: Offline; Teaching type: CLO3; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 3: Lecture 4. Developing a Risk Management Plan
4.1 Objectives and Scope of a Risk Management Plan
4.2 Assigning Responsibilities, Procedures and Schedules for Accomplishment
Topic: Offline; Teaching type: CLO4; LO: T
ITU: Read Chapter 4
Download: Study and Review Lecture 4

Session 4: Lecture 4. Developing a Risk Management Plan
4.3 Reporting Requirements, Plan of Action and Milestones
4.4 Charting the Progress of a Risk Management Plan
Topic: Offline; Teaching type: CLO4; LO: T
ITU: Read Chapter 4
Download: Study and Review Lecture 4
CLO12: Perform a business impact analysis.
Session 1: The AI Auditor: Teams present their top 5 identified risks.
Another team or an AI prompt (e.g., "Act as a skeptical internal auditor") challenges the analysis for completeness and relevance to COBIT.
Topic: Offline; Teaching type: CLO4; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 2: Guide: Define the Scope and Structure for an IT Risk Management Plan
Topic: Offline; Teaching type: CLO4; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 3: Lecture 5. Defining Risk Assessment Approaches
5.1 Understanding Critical Components of a Risk Assessment
Topic: Offline; Teaching type: CLO5; LO: T
ITU: Read Chapter 5
Download: Study and Review Lecture 5

Session 4: Lecture 5. Defining Risk Assessment Approaches
5.2 Types of Risk Assessments and Challenges
5.3 Best Practices for Risk Assessment
Topic: Offline; Teaching type: CLO5; LO: T
ITU: Read Chapter 5
Download: Study and Review Lecture 5
CLO13: Review a business continuity plan (BCP) based on the findings of a given risk assessment for an organization.
Session 1: Lecture 6. Performing a Risk Assessment
6.1 Selecting a Risk Assessment Methodology
6.2 Identifying the Management Structure, Assets and Activities Within Risk Assessment Boundaries

Solution Design: Propose mitigation solutions for identified risks.
Deliverable: Draft solution framework (diagram, flowchart, or risk management plan outline).
Mid-point check-in presentation (15 minutes/team) for instructor feedback.
Topic: Offline; Teaching type: CLO6; LO: T
ITU: Read Chapter 6
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 2: Lecture 6. Performing a Risk Assessment
6.3 Identifying and Evaluating Relevant Threats, Vulnerabilities and Countermeasures
6.4 Selecting a Methodology Based on Assessment Needs
Topic: Offline; Teaching type: CLO6; LO: T
ITU: Read Chapter 6
Download: Study and Review Lecture 6

Session 3: Lecture 6. Performing a Risk Assessment
6.5 Developing Mitigating Recommendations and Presenting Risk Assessment Results
Topic: Offline; Teaching type: CLO6; LO: T
ITU: Read Chapter 6
Download: Study and Review Lecture 6

Session 4: Lecture 6. Performing a Risk Assessment
6.6 Best Practices for Performing Risk Assessments
Topic: Offline; Teaching type: CLO6; LO: T
ITU: Read Chapter 6
Download: Study and Review Lecture 6
CLO14: Review a disaster recovery plan (DRP) based on the findings of a given risk assessment for an organization.
Session 1: Review Assessment 1
Topic: Offline; Teaching type: CLO1, CLO2, CLO3, CLO4, CLO5; LO: U
ITU: Present/demo Part1
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 2: Review Assessment 1
Topic: Offline; Teaching type: CLO1, CLO2, CLO3, CLO4, CLO5; LO: U
ITU: Present/demo Part1
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 3: Review Assessment 1
Topic: Offline; Teaching type: CLO1, CLO2, CLO3, CLO4, CLO5; LO: U
ITU: Present/demo Part1
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 4: Lecture 7. Identifying Assets and Activities to Be Protected
7.1 System Access and Availability
7.2 System Functions: Manual and Automated
Topic: Offline; Teaching type: CLO7; LO: T
ITU: Read Chapter 7
Download: Study and Review Lecture 7
CLO15: Review a computer incident response team (CIRT) plan for an organization.
Session 1: Lecture 7. Identifying Assets and Activities to Be Protected
7.3 Hardware, Software and Personnel Assets
7.4 Data and Information Assets
Topic: Offline; Teaching type: CLO7; LO: T
ITU: Read Chapter 7
Download: Study and Review Lecture 7

Session 2: Lecture 7. Identifying Assets and Activities to Be Protected
7.5 Asset and Inventory Management Within the Seven Domains of a Typical IT Infrastructure
Topic: Offline; Teaching type: CLO7; LO: T
ITU: Read Chapter 7
Download: Study and Review Lecture 7

Session 3: Lecture 7. Identifying Assets and Activities to Be Protected
7.6 Identifying Facilities and Supplies Needed to Maintain Business Operations
Topic: Offline; Teaching type: CLO7; LO: T
ITU: Read Chapter 7
Download: Study and Review Lecture 7

Session 4: Lectures 8. Identifying and Analyzing Threats, Vulnerabilities, and Exploits
8.1 Threat Assessments
8.2 Vulnerability Assessments
Topic: Offline; Teaching type: CLO8; LO: T
ITU: Read Chapter 8
Download: Study and Review Lecture 8
CLO2: Understand methods of mitigating risk by managing threats, vulnerabilities, and exploits.
Session 1: Lectures 8. Identifying and Analyzing Threats, Vulnerabilities, and Exploits
8.3 Exploit Assessments
Topic: Offline; Teaching type: CLO8; LO: T
ITU: Read Chapter 8
Download: Study and Review Lecture 8

Session 2: AI-Supported Evaluation: Teams use AI to test and critique proposed risk assessments (e.g., ask AI to act as an auditor).
Deliverable: AI Evaluation Log – 1–2 pages explaining suggestions and team refinements.
Topic: Offline; Teaching type: CLO8; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 3: Structured Peer Review: Teams swap reports and provide feedback using a provided rubric.
Subsequently, use AI to summarize the peer feedback and identify common strengths/weaknesses across all reviews
Topic: Offline; Teaching type: CLO8; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 4: Implementation / Case Study Detailing: Develop detailed risk mitigation plans or case studies.
Deliverable: Progress Report (4–5 pages) with initial results.
Topic: Offline; Teaching type: CLO8; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students
CLO3: Identify compliance laws, standards, best practices, and policies of risk management.
Session 1: Lectures 9. Identifying and Analyzing Risk Mitigation Security Controls
9.1 In-Place Controls, Planned Controls and Control Categories
9.2 Procedural Control Examples
Topic: Offline; Teaching type: CLO9; LO: T
ITU: Read Chapter 9
Download: Study and Review Lecture 9

Session 2: Lectures 9. Identifying and Analyzing Risk Mitigation Security Controls
9.3 Technical Control Examples
9.4 Physical Control Examples
9.5 Best Practices for Risk Mitigation Security Controls
Topic: Offline; Teaching type: CLO9; LO: T
ITU: Read Chapter 9
Download: Study and Review Lecture 9

Session 3: Lectures 10. Planning Risk Mitigation Throughout Your Organization
10.1 The Scope of Risk Management for Your Organization
10.2 Understanding and Assessing the Impact of Legal and Compliance Issues on Your Organization
Topic: Offline; Teaching type: CLO10; LO: T
ITU: Read Chapter 10
Download: Study and Review Lecture 10

Session 4: Lectures 10. Planning Risk Mitigation Throughout Your Organization
10.3 Translating Legal and Compliance Implications
10.4 Assessing the Impact of Legal and Compliance Implications on the Seven Domains of a Typical IT Infrastructure
Topic: Offline; Teaching type: CLO10; LO: T
ITU: Read Chapter 10
Download: Study and Review Lecture 10
CLO4: Describe the components of an effective risk management plan.
Session 1: Lectures 10. Planning Risk Mitigation Throughout Your Organization
10.5 Assessing How Security Countermeasures and Safeguards Can Assist with Risk Mitigation
10.6 Understanding the Operational Implications of Legal and Compliance Requirements
Topic: Offline; Teaching type: CLO10; LO: T
ITU: Read Chapter 10
Download: Study and Review Lecture 10

Session 2: Lectures 10. Planning Risk Mitigation Throughout Your Organization
10.7 Identifying Risk Mitigation and Risk Reduction Elements for the Entire Organization
10.8 Performing a Cost-Benefit Analysis
10.9 Best Practices for Planning Risk Mitigation Throughout Your organization
Topic: Offline; Teaching type: CLO10; LO: T
ITU: Read Chapter 10
Download: Study and Review Lecture 10

Session 3: The Cost-Benefit Challenge: Teams propose their chosen mitigation controls.
Other teams/AI (prompt: "Act as a CFO focused on ROI") challenge the cost-benefit analysis and operational feasibility.
Topic: Offline; Teaching type: CLO10; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 4: Review Assessment 2
Topic: Offline; Teaching type: CLO6, CLO7, CLO8, CLO9, CLO10; LO: U
ITU: Present/demo Part2
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students
CLO5: Describe approaches for identifying and analyzing relevant threats, vulnerabilities, and exploits.
Session 1: Review Assessment 2
Topic: Offline; Teaching type: CLO6, CLO7, CLO8, CLO9, CLO10; LO: U
ITU: Present/demo Part2
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 2: Lectures 11. Turning Your Risk Assessment into a Risk Mitigation Plan
11.1 Translating Your Risk Assessment into a Risk Mitigation Plan
11.2 Prioritizing and Verifying Risk Elements and How These Risks Can Be Mitigated
11.3 Performing a CBA on the Identified Risk Elements
Topic: Offline; Teaching type: CLO11; LO: T
ITU: Read Chapter 11
Download: Study and Review Lecture 11

Session 3: Lectures 11. Turning Your Risk Assessment into a Risk Mitigation Plan
11.4 Implementing and Following Up on the Risk Mitigation Plan
11.5 Best Practices for Enabling a Risk Mitigation Plan from Your Risk Assessment
Topic: Offline; Teaching type: CLO11; LO: T
ITU: Read Chapter 11
Download: Study and Review Lecture 11

Session 4: Lectures 12. Mitigating Risk with a Business Impact Analysis
12.1 The Scope and Objectives of a BIA
12.2 The Steps of a BIA Process
12.3 Identifying Mission-Critical Business Functions and Processes
Topic: Offline; Teaching type: CLO12; LO: T
ITU: Read Chapter 12
Download: Study and Review Lecture 12
CLO6: Describe the process of performing risk assessments.
Session 1: Lectures 12. Mitigating Risk with a Business Impact Analysis
12.4 Mapping Business Functions and Processes to IT Systems
12.5 Best Practices for Performing a BIA for Your Organization
Topic: Offline; Teaching type: CLO12; LO: T
ITU: Read Chapter 12
Download: Study and Review Lecture 12

Session 2: Plan Consolidation: Integrate all components (BIA, BCP, DRP, CIRT) into a unified Risk Management Framework document.
Topic: Offline; Teaching type: CLO12; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 3: Lectures 13. Mitigating Risk with a Business Continuity Plan
13.1 Elements of a BCP
13.2 How Does a BCP Mitigate an Organization's Risk?
Topic: Offline; Teaching type: CLO13; LO: T
ITU: Read Chapter 13
Download: Study and Review Lecture 13

Session 4: Lectures 13. Mitigating Risk with a Business Continuity Plan
13.3 Best Practices for Implementing a BCP for Your Organization
Topic: Offline; Teaching type: CLO13; LO: T
ITU: Read Chapter 13
Download: Study and Review Lecture 13
CLO7: Identify assets and activities to be protected within an organization.
Session 1: Lectures 14. Mitigating Risk with a Disaster Recovery Plan
14.1 Critical Success Factors of a DRP
14.2 Elements of a DRP
Topic: Offline; Teaching type: CLO14; LO: T
ITU: Read Chapter 14
Download: Study and Review Lecture 14

Session 2: Lectures 14. Mitigating Risk with a Disaster Recovery Plan
14.3 How Does a DRP Mitigate an Organization's Risk?
14.4 Best Practices for Implementing a DRP for Your Organization
Topic: Offline; Teaching type: CLO14; LO: T
ITU: Read Chapter 14
Download: Study and Review Lecture 14

Session 3: Lectures 15. Mitigating Risk with a Computer Incident Response Team Plan
15.1 Purpose and Elements of a CIRT Plan
15.2 How Does a CIRT Plan Mitigate an Organization's Risk?
Topic: Offline; Teaching type: CLO15; LO: T
ITU: Read Chapter 15
Download: Study and Review Lecture 15

Session 4: Lectures 15. Mitigating Risk with a Computer Incident Response Team Plan
15.3 Best Practices for Implementing a CI RT Plan for Your Organization
Topic: Offline; Teaching type: CLO15; LO: T
ITU: Read Chapter 15
Download: Study and Review Lecture 15
CLO8: Identify and analyze threats, vulnerabilities, and exploits.
Session 1: Review Assessment 3
Topic: Offline; Teaching type: CLO11, CLO12, CLO13, CLO14, CLO15; LO: U
ITU: Present/demo Part3
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 2: Review Assessment 3
Topic: Offline; Teaching type: CLO11, CLO12, CLO13, CLO14, CLO15; LO: U
ITU: Present/demo Part3
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 3: Final Project Preparation
Topic: Offline; Teaching type: CLO1, CLO2, CLO3, CLO4, CLO5,CLO6, CLO7, CLO8, CLO9, CLO10,CLO11, CLO12, CLO13, CLO14, CLO15; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 4: Final Project Preparation
Topic: Offline; Teaching type: CLO1, CLO2, CLO3, CLO4, CLO5,CLO6, CLO7, CLO8, CLO9, CLO10,CLO11, CLO12, CLO13, CLO14, CLO15; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students
CLO9: Identify and analyze risk mitigation security controls.
Session 1: Final Project Preparation
Topic: Offline; Teaching type: CLO1, CLO2, CLO3, CLO4, CLO5,CLO6, CLO7, CLO8, CLO9, CLO10,CLO11, CLO12, CLO13, CLO14, CLO15; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 2: Final Project Preparation
Topic: Offline; Teaching type: CLO1, CLO2, CLO3, CLO4, CLO5,CLO6, CLO7, CLO8, CLO9, CLO10,CLO11, CLO12, CLO13, CLO14, CLO15; LO: U
ITU: Lecture Slides
Download: https://flm.fpt.edu.vn/gui/role/student/Support/guide students

Session 3: Final Project Presentation
Topic: Offline; Teaching type: CLO1, CLO2, CLO3, CLO4, CLO5,CLO6, CLO7, CLO8, CLO9, CLO10,CLO11, CLO12, CLO13, CLO14, CLO15; LO: U
ITU: Present/demo last work results
Download: Evaluate students

Session 4: Final Project Presentation
Topic: Offline; Teaching type: CLO1, CLO2, CLO3, CLO4, CLO5,CLO6, CLO7, CLO8, CLO9, CLO10,CLO11, CLO12, CLO13, CLO14, CLO15; LO: U
ITU: Present/demo last work results
Download: Evaluate students