MSc

MSc UK SME Cyber and ICO-Facing Practice

ICO complaints, ransomware, and SME controls—not CISSP and not a hacking course.

Online or on campus

18 months36 creditsEnglish (dual pathway: Edinburgh campus or tuition-free online; one academic standard)

MSc UK SME Cyber and ICO-Facing Practice

Overview

SMEs do not fail cyber because they lack a Silicon Valley SOC; they fail because backups were a myth, MFA was optional, and nobody owned the ICO clock. This MSc starts there. You will map a ransomware weekend for a ten-person firm, write a personal-data inventory that is not a lie, and brief a director without claiming a hacking qualification. Scottish and rUK SMEs sit in the cases: professional services in Edinburgh, manufacturers in the Central Belt, care and education suppliers who hold children’s data. Dual-pathway students sit the same assessments. Faculty mark whether you can separate UK GDPR, PECR, and NIS-adjacent duties without dumping a US NIST poster as the whole answer. The degree is not CISSP, not a penetration-testing licence, not ICO employment. Offensive techniques are not taught as a curriculum outcome. Capstones must improve a control environment, not demonstrate intrusion. ICO-facing clocks, children’s data in small education suppliers, and invoice-fraud on a Friday afternoon are the Scottish and UK cases, not a Silicon Valley breach memoir. University of Brigant will not display NCSC, ICO, or CISSP marks. You will still be expected to brief a director in plain English about residual risk after MFA and backups are real rather than slideware. MSc UK SME Cyber and ICO-Facing Practice is taught as one award, not a list of unrelated modules. The published length is 18 months, and the credit total is 36. Students move from UK GDPR and PECR for SME Operators through UK GDPR and PECR for SME Operators; ICO Processes, SARs, and Complaint Clocks; NIS-Adjacent Duties without Operator Theatre; Identity, MFA, and Backup Reality; Phishing, Invoice Fraud, and Staff Culture; Cloud, Laptops, and Home Working in SMEs, and finish on Tabletop Exercises that Are Not LARP Hacking. Each course has a question, a method, and a submission. In this field, students map one named system, write a threat model, and specify the controls that would stop the most likely path. Reading is control catalogues, incident write-ups, and a short technical standard. The artefact a marker expects is a defensive design with a test plan and a statement of residual risk. The award is built so that a graduate can do the following in practice: Design proportionate SME controls and backup reality tests Run an ICO-facing complaint or SAR timeline as operations Write an incident log a director and an insurer can read Teaching assumes the student can read a source, attempt a problem before the seminar, and revise after feedback. Attendance at live seminars is part of the design. The capstone or final course must use the methods of the earlier courses; a project that ignores them does not pass. The pages for each course name the topics that are examined. Those topics are the syllabus. A brochure line is not a substitute for them.

Thirty-six credits: UK legal-operational cyber for SMEs, ICO-facing processes, incident and supplier risk, and a supervised controls capstone. Dual pathway. Explicit non-CISSP, non-offensive marketing.

Who This Programme Is For

SME operations, IT, and office managers who own cyber by default
DPO-adjacent staff in small organisations (not automatic DPO appointment)
Professional-services and care/education suppliers holding UK personal data
Consultants who refuse CISSP-theatre for ten-person firms

How you can study

Recommended

Study online

100% tuition-free online

Online tuition is free. Online examinations are free. There is no exam fee for online study.

✦ Tuition: £0 / $0
✦ Examinations are free. There is no exam fee.
✦ Learn from anywhere · Live online seminars

Apply online →

On-campus study

Study at our campus

Prefer to learn at our Edinburgh campus? Campus tuition and campus examinations are charged. The published campus price is on each programme page.

✦ Tuition: £9,500 / US$12,000/year
✦ Location: 3 Lady Lawson St, Edinburgh EH3 9DS, United Kingdom
✦ Campus examinations are charged
✦ In-person seminars, library & student services

Apply for campus →

What You Will Learn

Design proportionate SME controls and backup reality tests
Run an ICO-facing complaint or SAR timeline as operations
Write an incident log a director and an insurer can read
Brief suppliers and staff without claiming CISSP
Refuse offensive-cyber framing in public descriptions of the award

Curriculum

Module 1: UK legal-operational baseline

Code	Course	Credits · hours
UOB701	UK GDPR and PECR for SME Operators UK GDPR and PECR for SME Operators (UOB701) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using UK GDPR and PECR for SME Operators as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB701-M1 · Assets, trust boundaries, and the adversary model — UK GDPR and PECR for SME Operators UOB701-M2 · Threat modelling and attack paths — UK GDPR and PECR for SME Operators UOB701-M3 · Identity, logging, and segmentation — UK GDPR and PECR for SME Operators UOB701-M4 · Detection, containment, and evidence — UK GDPR and PECR for SME Operators UOB701-M5 · Residual risk and what a control does not stop — UK GDPR and PECR for SME Operators UOB701-M6 · Defensive design, test plan, and after-action review — UK GDPR and PECR for SME Operators	3 · 30 h
UOB702	ICO Processes, SARs, and Complaint Clocks ICO Processes, SARs, and Complaint Clocks (UOB702) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using ICO Processes, SARs, and Complaint Clocks as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB702-M1 · Assets, trust boundaries, and the adversary model — ICO Processes, SARs, and Complaint Clocks UOB702-M2 · Threat modelling and attack paths — ICO Processes, SARs, and Complaint Clocks UOB702-M3 · Identity, logging, and segmentation — ICO Processes, SARs, and Complaint Clocks UOB702-M4 · Detection, containment, and evidence — ICO Processes, SARs, and Complaint Clocks UOB702-M5 · Residual risk and what a control does not stop — ICO Processes, SARs, and Complaint Clocks UOB702-M6 · Defensive design, test plan, and after-action review — ICO Processes, SARs, and Complaint Clocks	3 · 30 h
UOB703	NIS-Adjacent Duties without Operator Theatre NIS-Adjacent Duties without Operator Theatre (UOB703) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using NIS-Adjacent Duties without Operator Theatre as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB703-M1 · Assets, trust boundaries, and the adversary model — NIS-Adjacent Duties without Operator Theatre UOB703-M2 · Threat modelling and attack paths — NIS-Adjacent Duties without Operator Theatre UOB703-M3 · Identity, logging, and segmentation — NIS-Adjacent Duties without Operator Theatre UOB703-M4 · Detection, containment, and evidence — NIS-Adjacent Duties without Operator Theatre UOB703-M5 · Residual risk and what a control does not stop — NIS-Adjacent Duties without Operator Theatre UOB703-M6 · Defensive design, test plan, and after-action review — NIS-Adjacent Duties without Operator Theatre	3 · 30 h

Code

Course

Credits · hours

UOB701

UK GDPR and PECR for SME Operators

UK GDPR and PECR for SME Operators (UOB701) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using UK GDPR and PECR for SME Operators as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB701-M1 · Assets, trust boundaries, and the adversary model — UK GDPR and PECR for SME Operators
UOB701-M2 · Threat modelling and attack paths — UK GDPR and PECR for SME Operators
UOB701-M3 · Identity, logging, and segmentation — UK GDPR and PECR for SME Operators
UOB701-M4 · Detection, containment, and evidence — UK GDPR and PECR for SME Operators
UOB701-M5 · Residual risk and what a control does not stop — UK GDPR and PECR for SME Operators
UOB701-M6 · Defensive design, test plan, and after-action review — UK GDPR and PECR for SME Operators

3 · 30 h

UOB702

ICO Processes, SARs, and Complaint Clocks

ICO Processes, SARs, and Complaint Clocks (UOB702) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using ICO Processes, SARs, and Complaint Clocks as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB702-M1 · Assets, trust boundaries, and the adversary model — ICO Processes, SARs, and Complaint Clocks
UOB702-M2 · Threat modelling and attack paths — ICO Processes, SARs, and Complaint Clocks
UOB702-M3 · Identity, logging, and segmentation — ICO Processes, SARs, and Complaint Clocks
UOB702-M4 · Detection, containment, and evidence — ICO Processes, SARs, and Complaint Clocks
UOB702-M5 · Residual risk and what a control does not stop — ICO Processes, SARs, and Complaint Clocks
UOB702-M6 · Defensive design, test plan, and after-action review — ICO Processes, SARs, and Complaint Clocks

3 · 30 h

UOB703

NIS-Adjacent Duties without Operator Theatre

NIS-Adjacent Duties without Operator Theatre (UOB703) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using NIS-Adjacent Duties without Operator Theatre as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB703-M1 · Assets, trust boundaries, and the adversary model — NIS-Adjacent Duties without Operator Theatre
UOB703-M2 · Threat modelling and attack paths — NIS-Adjacent Duties without Operator Theatre
UOB703-M3 · Identity, logging, and segmentation — NIS-Adjacent Duties without Operator Theatre
UOB703-M4 · Detection, containment, and evidence — NIS-Adjacent Duties without Operator Theatre
UOB703-M5 · Residual risk and what a control does not stop — NIS-Adjacent Duties without Operator Theatre
UOB703-M6 · Defensive design, test plan, and after-action review — NIS-Adjacent Duties without Operator Theatre

3 · 30 h

Module 2: Controls that fit ten to two-hundred people

Code	Course	Credits · hours
UOB705	Identity, MFA, and Backup Reality Identity, MFA, and Backup Reality (UOB705) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Identity, MFA, and Backup Reality as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB705-M1 · Assets, trust boundaries, and the adversary model — Identity, MFA, and Backup Reality UOB705-M2 · Threat modelling and attack paths — Identity, MFA, and Backup Reality UOB705-M3 · Identity, logging, and segmentation — Identity, MFA, and Backup Reality UOB705-M4 · Detection, containment, and evidence — Identity, MFA, and Backup Reality UOB705-M5 · Residual risk and what a control does not stop — Identity, MFA, and Backup Reality UOB705-M6 · Defensive design, test plan, and after-action review — Identity, MFA, and Backup Reality	3 · 30 h
UOB706	Phishing, Invoice Fraud, and Staff Culture Phishing, Invoice Fraud, and Staff Culture (UOB706) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Phishing, Invoice Fraud, and Staff Culture as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB706-M1 · Assets, trust boundaries, and the adversary model — Phishing, Invoice Fraud, and Staff Culture UOB706-M2 · Threat modelling and attack paths — Phishing, Invoice Fraud, and Staff Culture UOB706-M3 · Identity, logging, and segmentation — Phishing, Invoice Fraud, and Staff Culture UOB706-M4 · Detection, containment, and evidence — Phishing, Invoice Fraud, and Staff Culture UOB706-M5 · Residual risk and what a control does not stop — Phishing, Invoice Fraud, and Staff Culture UOB706-M6 · Defensive design, test plan, and after-action review — Phishing, Invoice Fraud, and Staff Culture	3 · 30 h
UOB707	Cloud, Laptops, and Home Working in SMEs Cloud, Laptops, and Home Working in SMEs (UOB707) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Cloud, Laptops, and Home Working in SMEs as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB707-M1 · Assets, trust boundaries, and the adversary model — Cloud, Laptops, and Home Working in SMEs UOB707-M2 · Threat modelling and attack paths — Cloud, Laptops, and Home Working in SMEs UOB707-M3 · Identity, logging, and segmentation — Cloud, Laptops, and Home Working in SMEs UOB707-M4 · Detection, containment, and evidence — Cloud, Laptops, and Home Working in SMEs UOB707-M5 · Residual risk and what a control does not stop — Cloud, Laptops, and Home Working in SMEs UOB707-M6 · Defensive design, test plan, and after-action review — Cloud, Laptops, and Home Working in SMEs	3 · 30 h

Code

Course

Credits · hours

UOB705

Identity, MFA, and Backup Reality

Identity, MFA, and Backup Reality (UOB705) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Identity, MFA, and Backup Reality as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB705-M1 · Assets, trust boundaries, and the adversary model — Identity, MFA, and Backup Reality
UOB705-M2 · Threat modelling and attack paths — Identity, MFA, and Backup Reality
UOB705-M3 · Identity, logging, and segmentation — Identity, MFA, and Backup Reality
UOB705-M4 · Detection, containment, and evidence — Identity, MFA, and Backup Reality
UOB705-M5 · Residual risk and what a control does not stop — Identity, MFA, and Backup Reality
UOB705-M6 · Defensive design, test plan, and after-action review — Identity, MFA, and Backup Reality

3 · 30 h

UOB706

Phishing, Invoice Fraud, and Staff Culture

Phishing, Invoice Fraud, and Staff Culture (UOB706) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Phishing, Invoice Fraud, and Staff Culture as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB706-M1 · Assets, trust boundaries, and the adversary model — Phishing, Invoice Fraud, and Staff Culture
UOB706-M2 · Threat modelling and attack paths — Phishing, Invoice Fraud, and Staff Culture
UOB706-M3 · Identity, logging, and segmentation — Phishing, Invoice Fraud, and Staff Culture
UOB706-M4 · Detection, containment, and evidence — Phishing, Invoice Fraud, and Staff Culture
UOB706-M5 · Residual risk and what a control does not stop — Phishing, Invoice Fraud, and Staff Culture
UOB706-M6 · Defensive design, test plan, and after-action review — Phishing, Invoice Fraud, and Staff Culture

3 · 30 h

UOB707

Cloud, Laptops, and Home Working in SMEs

Cloud, Laptops, and Home Working in SMEs (UOB707) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Cloud, Laptops, and Home Working in SMEs as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB707-M1 · Assets, trust boundaries, and the adversary model — Cloud, Laptops, and Home Working in SMEs
UOB707-M2 · Threat modelling and attack paths — Cloud, Laptops, and Home Working in SMEs
UOB707-M3 · Identity, logging, and segmentation — Cloud, Laptops, and Home Working in SMEs
UOB707-M4 · Detection, containment, and evidence — Cloud, Laptops, and Home Working in SMEs
UOB707-M5 · Residual risk and what a control does not stop — Cloud, Laptops, and Home Working in SMEs
UOB707-M6 · Defensive design, test plan, and after-action review — Cloud, Laptops, and Home Working in SMEs

3 · 30 h

Module 3: Incidents and suppliers

Code	Course	Credits · hours
UOB709	Ransomware Weekends and Honest Downtime Ransomware Weekends and Honest Downtime (UOB709) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Ransomware Weekends and Honest Downtime as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB709-M1 · Assets, trust boundaries, and the adversary model — Ransomware Weekends and Honest Downtime UOB709-M2 · Threat modelling and attack paths — Ransomware Weekends and Honest Downtime UOB709-M3 · Identity, logging, and segmentation — Ransomware Weekends and Honest Downtime UOB709-M4 · Detection, containment, and evidence — Ransomware Weekends and Honest Downtime UOB709-M5 · Residual risk and what a control does not stop — Ransomware Weekends and Honest Downtime UOB709-M6 · Defensive design, test plan, and after-action review — Ransomware Weekends and Honest Downtime	3 · 30 h
UOB710	Insurers, Solicitors, and Notification Decisions Insurers, Solicitors, and Notification Decisions (UOB710) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Insurers, Solicitors, and Notification Decisions as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB710-M1 · Assets, trust boundaries, and the adversary model — Insurers, Solicitors, and Notification Decisions UOB710-M2 · Threat modelling and attack paths — Insurers, Solicitors, and Notification Decisions UOB710-M3 · Identity, logging, and segmentation — Insurers, Solicitors, and Notification Decisions UOB710-M4 · Detection, containment, and evidence — Insurers, Solicitors, and Notification Decisions UOB710-M5 · Residual risk and what a control does not stop — Insurers, Solicitors, and Notification Decisions UOB710-M6 · Defensive design, test plan, and after-action review — Insurers, Solicitors, and Notification Decisions	3 · 30 h
UOB711	Processor Contracts and Supply-Chain Weakest Links Processor Contracts and Supply-Chain Weakest Links (UOB711) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Processor Contracts and Supply-Chain Weakest Links as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB711-M1 · Assets, trust boundaries, and the adversary model — Processor Contracts and Supply-Chain Weakest Links UOB711-M2 · Threat modelling and attack paths — Processor Contracts and Supply-Chain Weakest Links UOB711-M3 · Identity, logging, and segmentation — Processor Contracts and Supply-Chain Weakest Links UOB711-M4 · Detection, containment, and evidence — Processor Contracts and Supply-Chain Weakest Links UOB711-M5 · Residual risk and what a control does not stop — Processor Contracts and Supply-Chain Weakest Links UOB711-M6 · Defensive design, test plan, and after-action review — Processor Contracts and Supply-Chain Weakest Links	3 · 30 h

Code

Course

Credits · hours

UOB709

Ransomware Weekends and Honest Downtime

Ransomware Weekends and Honest Downtime (UOB709) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Ransomware Weekends and Honest Downtime as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB709-M1 · Assets, trust boundaries, and the adversary model — Ransomware Weekends and Honest Downtime
UOB709-M2 · Threat modelling and attack paths — Ransomware Weekends and Honest Downtime
UOB709-M3 · Identity, logging, and segmentation — Ransomware Weekends and Honest Downtime
UOB709-M4 · Detection, containment, and evidence — Ransomware Weekends and Honest Downtime
UOB709-M5 · Residual risk and what a control does not stop — Ransomware Weekends and Honest Downtime
UOB709-M6 · Defensive design, test plan, and after-action review — Ransomware Weekends and Honest Downtime

3 · 30 h

UOB710

Insurers, Solicitors, and Notification Decisions

Insurers, Solicitors, and Notification Decisions (UOB710) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Insurers, Solicitors, and Notification Decisions as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB710-M1 · Assets, trust boundaries, and the adversary model — Insurers, Solicitors, and Notification Decisions
UOB710-M2 · Threat modelling and attack paths — Insurers, Solicitors, and Notification Decisions
UOB710-M3 · Identity, logging, and segmentation — Insurers, Solicitors, and Notification Decisions
UOB710-M4 · Detection, containment, and evidence — Insurers, Solicitors, and Notification Decisions
UOB710-M5 · Residual risk and what a control does not stop — Insurers, Solicitors, and Notification Decisions
UOB710-M6 · Defensive design, test plan, and after-action review — Insurers, Solicitors, and Notification Decisions

3 · 30 h

UOB711

Processor Contracts and Supply-Chain Weakest Links

Processor Contracts and Supply-Chain Weakest Links (UOB711) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Processor Contracts and Supply-Chain Weakest Links as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB711-M1 · Assets, trust boundaries, and the adversary model — Processor Contracts and Supply-Chain Weakest Links
UOB711-M2 · Threat modelling and attack paths — Processor Contracts and Supply-Chain Weakest Links
UOB711-M3 · Identity, logging, and segmentation — Processor Contracts and Supply-Chain Weakest Links
UOB711-M4 · Detection, containment, and evidence — Processor Contracts and Supply-Chain Weakest Links
UOB711-M5 · Residual risk and what a control does not stop — Processor Contracts and Supply-Chain Weakest Links
UOB711-M6 · Defensive design, test plan, and after-action review — Processor Contracts and Supply-Chain Weakest Links

3 · 30 h

Module 4: Capstone

Code	Course	Credits · hours
UOB713	Scottish SME and Professional-Services Cases Scottish SME and Professional-Services Cases (UOB713) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Scottish SME and Professional-Services Cases as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB713-M1 · Assets, trust boundaries, and the adversary model — Scottish SME and Professional-Services Cases UOB713-M2 · Threat modelling and attack paths — Scottish SME and Professional-Services Cases UOB713-M3 · Identity, logging, and segmentation — Scottish SME and Professional-Services Cases UOB713-M4 · Detection, containment, and evidence — Scottish SME and Professional-Services Cases UOB713-M5 · Residual risk and what a control does not stop — Scottish SME and Professional-Services Cases UOB713-M6 · Defensive design, test plan, and after-action review — Scottish SME and Professional-Services Cases	3 · 30 h
UOB714	Research Methods for Socio-Technical Controls Research Methods for Socio-Technical Controls (UOB714) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Research Methods for Socio-Technical Controls as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB714-M1 · Assets, trust boundaries, and the adversary model — Research Methods for Socio-Technical Controls UOB714-M2 · Threat modelling and attack paths — Research Methods for Socio-Technical Controls UOB714-M3 · Identity, logging, and segmentation — Research Methods for Socio-Technical Controls UOB714-M4 · Detection, containment, and evidence — Research Methods for Socio-Technical Controls UOB714-M5 · Residual risk and what a control does not stop — Research Methods for Socio-Technical Controls UOB714-M6 · Defensive design, test plan, and after-action review — Research Methods for Socio-Technical Controls	3 · 30 h
UOB715	Tabletop Exercises that Are Not LARP Hacking Tabletop Exercises that Are Not LARP Hacking (UOB715) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Tabletop Exercises that Are Not LARP Hacking as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. UOB715-M1 · Assets, trust boundaries, and the adversary model — Tabletop Exercises that Are Not LARP Hacking UOB715-M2 · Threat modelling and attack paths — Tabletop Exercises that Are Not LARP Hacking UOB715-M3 · Identity, logging, and segmentation — Tabletop Exercises that Are Not LARP Hacking UOB715-M4 · Detection, containment, and evidence — Tabletop Exercises that Are Not LARP Hacking UOB715-M5 · Residual risk and what a control does not stop — Tabletop Exercises that Are Not LARP Hacking UOB715-M6 · Defensive design, test plan, and after-action review — Tabletop Exercises that Are Not LARP Hacking	3 · 30 h

Code

Course

Credits · hours

UOB713

Scottish SME and Professional-Services Cases

Scottish SME and Professional-Services Cases (UOB713) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Scottish SME and Professional-Services Cases as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB713-M1 · Assets, trust boundaries, and the adversary model — Scottish SME and Professional-Services Cases
UOB713-M2 · Threat modelling and attack paths — Scottish SME and Professional-Services Cases
UOB713-M3 · Identity, logging, and segmentation — Scottish SME and Professional-Services Cases
UOB713-M4 · Detection, containment, and evidence — Scottish SME and Professional-Services Cases
UOB713-M5 · Residual risk and what a control does not stop — Scottish SME and Professional-Services Cases
UOB713-M6 · Defensive design, test plan, and after-action review — Scottish SME and Professional-Services Cases

3 · 30 h

UOB714

Research Methods for Socio-Technical Controls

Research Methods for Socio-Technical Controls (UOB714) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Research Methods for Socio-Technical Controls as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB714-M1 · Assets, trust boundaries, and the adversary model — Research Methods for Socio-Technical Controls
UOB714-M2 · Threat modelling and attack paths — Research Methods for Socio-Technical Controls
UOB714-M3 · Identity, logging, and segmentation — Research Methods for Socio-Technical Controls
UOB714-M4 · Detection, containment, and evidence — Research Methods for Socio-Technical Controls
UOB714-M5 · Residual risk and what a control does not stop — Research Methods for Socio-Technical Controls
UOB714-M6 · Defensive design, test plan, and after-action review — Research Methods for Socio-Technical Controls

3 · 30 h

UOB715

Tabletop Exercises that Are Not LARP Hacking

Tabletop Exercises that Are Not LARP Hacking (UOB715) is a 3-credit course on MSc UK SME Cyber and ICO-Facing Practice, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Tabletop Exercises that Are Not LARP Hacking as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

UOB715-M1 · Assets, trust boundaries, and the adversary model — Tabletop Exercises that Are Not LARP Hacking
UOB715-M2 · Threat modelling and attack paths — Tabletop Exercises that Are Not LARP Hacking
UOB715-M3 · Identity, logging, and segmentation — Tabletop Exercises that Are Not LARP Hacking
UOB715-M4 · Detection, containment, and evidence — Tabletop Exercises that Are Not LARP Hacking
UOB715-M5 · Residual risk and what a control does not stop — Tabletop Exercises that Are Not LARP Hacking
UOB715-M6 · Defensive design, test plan, and after-action review — Tabletop Exercises that Are Not LARP Hacking

3 · 30 h

Career Paths

SME cyber and compliance lead (academic MSc; not CISSP)
Office/operations manager with data-protection ownership
Incident coordinator in a small organisation
Supplier-risk officer
DPO support analyst (appointment not conferred)

Programme Highlights

SME and ICO facing, not generic cybersecurity MSc
No CISSP or NCSC logos
Non-offensive curriculum boundary
Edinburgh or tuition-free online
Anonymised firm capstone

Assessment

Modules are assessed through a published mix of coursework, applied projects, and examinations. Exam windows are announced in advance so students in other time zones are not forced into overnight sittings. Alternative arrangements are available where documented.

Admission requirements

Academic entry

Bachelor's degree from a recognised institution (minimum 2:2 / GPA 2.5/4.0 or equivalent national scale)
Identity document for remote identity-checked assessment enrolment
Preferred: work in SME operations, IT support, or compliance; this is not a penetration-testing programme

English language

English proficiency: IELTS 5.5, TOEFL 46, or equivalent (waived for prior English-medium study). Dual-pathway applicants state Edinburgh campus or tuition-free online as primary mode without changing academic standards. Gaelic/Scots programmes may require additional language evidence as stated on the programme page.

Documents

Statement of Purpose (500 words minimum) stating goals, professional context, and fit
Two academic or professional references with verifiable contact details
CV or résumé covering education and relevant work
Official transcripts (digital copies accepted at application; certified copies before award)

Programme questions

How long is the MSc UK SME Cyber and ICO-Facing Practice?

The published duration is 18 months. Teaching language: English (dual pathway: Edinburgh campus or tuition-free online; one academic standard). Actual time-to-complete depends on mode and any recognised prior learning.

Can I study this from my country?

You may study this award fully online from your country, or — where published — on campus at Brigant. Online study does not require a student visa. Campus study may.

What does it cost?

Degree tuition for this award is published as £0 / tuition-free on the online pathway. Examination or administrative fees may apply at checkout — never an annual tuition invoice. Check the Fees page for any extras.

What are the entry requirements?

Requirements are grouped on this page (academic, English, documents). Equivalent qualifications are considered. English may be waived after prior English-medium study.

How is the programme assessed?

Assessment is typically a mix of coursework, projects, and examinations. Doctoral awards include a thesis or dissertation and an oral examination. Details sit in the programme specification and module outlines.

Will this award be recognised where I live?

Recognition of the award for local employment, professional licence, or ministry attestation is decided by your employer or regulator. University of Brigant publishes verification pages for certificates. We do not claim automatic equivalence in every country.

How do I apply?

Start an application on this website. Progress is saved from the first step. Admissions: admissions@brigant.uk.

Recognised & Accredited

Ready to begin?MSc UK SME Cyber and ICO-Facing Practice

Start an application

Loading…