Apply now
Master'sBusiness, Management & Technology Policy Applications open

Master’s in Enterprise Cyber-Resilience Engineering

Online master's programme of 1,900 hours in enterprise cyber resilience engineering. 12 modules covering risk and resilience, NIS2, DORA and the Cyber Resilience Act, ISO/IEC 27001 and ISO 22301 management systems, incident management, secure architectures, OT security, supply chain risk, resilience testing and FAIR risk quantification, with an assigned technical tutor.

Duration1900 h
ModeOnline
LanguageEnglish
Start datesSet by the faculty
AwardSEIUM Institute diploma
Enrol now View syllabus Ask an advisor
Virtual lab · try it before you enrol

Take the controls.

Run a real engineering trade-off from this programme. Move the sliders, watch the model react in real time and beat the challenge.

SIM · LIVE ●
Learning outcomes

What you will be able to do

01

Analyse cyber risk and its impact on the business.

02

Apply the requirements of NIS2, DORA and the Cyber Resilience Act.

03

Implement ISO/IEC 27001 and ISO 22301 management systems.

04

Design incident response and business continuity plans.

05

Assess the security of suppliers and the supply chain.

06

Plan resilience tests and exercises.

07

Quantify risk to support senior management decisions.

Profile

Who it's for

  • Information security managers responsible for an ISMS or a security function.
  • Business continuity managers preparing for ransomware and major outages.
  • Cybersecurity consultants advising on NIS2 and DORA compliance.
  • Management system auditors working with ISO/IEC 27001 and ISO 22301.
  • Technology risk analysts who need to quantify and report cyber risk.
  • Compliance officers facing new European cyber regulation.
  • Engineering or science graduates seeking to enter banking and insurance.
Standards & tools

What you'll work with

  • Directive (EU) 2022/2555 NIS2 (cybersecurity of network and information systems)
  • Regulation (EU) 2022/2554 DORA (digital operational resilience of the financial sector)
  • ISO/IEC 27001:2022 (information security management systems)
  • Regulation (EU) 2024/2847 (Cyber Resilience Act)
  • ISO 22301:2019 (business continuity management)
  • Royal Decree 311/2022 (Spanish National Security Framework, ENS)
  • ISO/IEC 27035-1:2023 (information security incident management)
  • IEC 62443-3-3:2013 (industrial control system security requirements)
  • Microsoft Sentinel
  • Splunk
  • PILAR
  • Wazuh
  • Veeam
Syllabus

12 modules · 1900 h

  1. 1.1Concepts of risk, threat and vulnerability
  2. 1.2The concept of operational resilience
  3. 1.3Risk management according to ISO 31000
  4. 1.4Risk appetite and tolerance
  5. 1.5The current threat landscape
  6. 1.6Ransomware and extortion
  7. 1.7Supply chain attacks
  8. 1.8Economic impact of incidents
  9. 1.9Corporate risk governance
  10. 1.10Case study: analysis of an attack on an industrial company
  1. 2.1The NIS2 Directive and essential entities
  2. 2.2The DORA Regulation for the financial sector
  3. 2.3The Cyber Resilience Act for products
  4. 2.4The Critical Entities Resilience Directive
  5. 2.5The Spanish National Security Framework (ENS)
  6. 2.6Incident notification
  7. 2.7Accountability of management bodies
  8. 2.8Penalty regime and fines
  9. 2.9Supervision and competent authorities
  10. 2.10Practical exercise: NIS2 applicability analysis for a company
  1. 3.1ISO/IEC 27001 and Annex A
  2. 3.2Statement of Applicability
  3. 3.3Risk analysis with MAGERIT
  4. 3.4The NIST CSF 2.0 framework
  5. 3.5CIS Critical Security Controls
  6. 3.6Policies and procedures
  7. 3.7Security metrics
  8. 3.8Internal audit of the system
  9. 3.9Certification and continual improvement
  10. 3.10Workshop: Statement of Applicability for an SME
  1. 4.1ISO 22301 management system
  2. 4.2Business impact analysis
  3. 4.3RTO and RPO objectives
  4. 4.4Continuity strategies
  5. 4.5Continuity and recovery plans
  6. 4.6Immutable backups
  7. 4.7Alternate sites and the cloud
  8. 4.8Testing and exercises
  9. 4.9Crisis communication
  10. 4.10Case study: ransomware continuity plan
  1. 5.1The incident response cycle
  2. 5.2Management according to ISO/IEC 27035
  3. 5.3Security operations centres
  4. 5.4Detection with SIEM
  5. 5.5Basic forensic analysis
  6. 5.6Containment and eradication
  7. 5.7Coordination with national CSIRTs
  8. 5.8Post-incident lessons learned
  9. 5.9Cyber insurance and expert assessment
  10. 5.10Practical exercise: incident tabletop exercise
  1. 6.1Zero trust architecture
  2. 6.2Network segmentation
  3. 6.3Identity and access management
  4. 6.4Multi-factor authentication and passwords
  5. 6.5Cloud security
  6. 6.6Endpoint protection with EDR
  7. 6.7Encryption and key management
  8. 6.8Email security
  9. 6.9Backups and redundancy
  10. 6.10Lab: segmentation design for a corporate network
  1. 7.1Differences between IT and OT
  2. 7.2The IEC 62443 standard
  3. 7.3The Purdue model
  4. 7.4Vulnerable industrial protocols
  5. 7.5Passive monitoring of OT networks
  6. 7.6Remote maintenance access
  7. 7.7Patch management in OT
  8. 7.8Physical and logical security
  9. 7.9Notable industrial incidents
  10. 7.10Case study: assessment of a manufacturing plant
  1. 8.1Inventory of critical suppliers
  2. 8.2Security due diligence
  3. 8.3Contractual security clauses
  4. 8.4Continuous supplier assessment
  5. 8.5Security of acquired software
  6. 8.6Software bills of materials (SBOM)
  7. 8.7Concentration on cloud providers
  8. 8.8Exit plans
  9. 8.9DORA requirements on third parties
  10. 8.10Workshop: supplier assessment questionnaire
  1. 9.1Social engineering attacks
  2. 9.2Awareness and training
  3. 9.3Phishing simulations
  4. 9.4Managing the insider threat
  5. 9.5Security culture
  6. 9.6Behaviour in a crisis
  7. 9.7Security in remote working
  8. 9.8Culture indicators
  9. 9.9Managing security talent
  10. 9.10Practical exercise: awareness campaign
  1. 10.1Vulnerability assessment
  2. 10.2Penetration testing
  3. 10.3Red team exercises
  4. 10.4Testing under the TIBER-EU framework
  5. 10.5Recovery testing
  6. 10.6Sector-wide crisis drills
  7. 10.7Maturity assessment
  8. 10.8Remediation plans
  9. 10.9Reporting to senior management
  10. 10.10Case study: annual testing programme
  1. 11.1Risk quantification with FAIR
  2. 11.2Security budgets
  3. 11.3Return on security investment
  4. 11.4Management committees and reporting
  5. 11.5The role of the CISO
  6. 11.6Risk transfer
  7. 11.7Indicators for the board
  8. 11.8Multi-year cyber resilience strategy
  9. 11.9Relationship with audit and compliance
  10. 11.10Workshop: FAIR quantification of a scenario
  1. 12.1Selecting the target organisation
  2. 12.2Maturity assessment
  3. 12.3Risk analysis with MAGERIT
  4. 12.4Applicable regulatory requirements
  5. 12.5Designing resilience measures
  6. 12.6Continuity plan
  7. 12.7Investment plan
  8. 12.8Implementation roadmap
  9. 12.9Master's Thesis report
  10. 12.10Master's Thesis: defence before a panel
Methodology, software & labs

How you'll learn

The programme is delivered 100% online on the SEIUM campus, with downloadable materials, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within each intake, so you can combine it with your job.

Each module combines theory, guided reading of the original standards and applied exercises. The working software is Microsoft Sentinel, Splunk, PILAR, Wazuh and Veeam, in free, academic or evaluation versions. Exercises are based on real procedures: a tabletop exercise responding to a ransomware attack, a business impact analysis of critical processes and an NIS2 compliance assessment of a company. Assessment is continuous by module, plus the final Master's Thesis.

Standards covered: Directive (EU) 2022/2555 (NIS2), Regulation (EU) 2022/2554 (DORA), ISO/IEC 27001:2022, Regulation (EU) 2024/2847 (Cyber Resilience Act), ISO 22301:2019, Royal Decree 311/2022 (ENS), ISO/IEC 27035-1:2023 and IEC 62443-3-3:2013.

Assigned technical tutor:every module ends with a deliverable that your tutor marks individually.
Standards-based learning:guided reading of NIS2, DORA and ISO/IEC 27001 applied to real cases, not as a theoretical annex.
Industry software:Microsoft Sentinel, Splunk, PILAR, Wazuh and Veeam, in free, academic or evaluation versions.
Master's Thesis with defence:a cyber resilience plan for a real organisation, with risk analysis, continuity plan, investment plan and implementation roadmap, defended before a panel.
Flexible format:100% online, no fixed timetables, compatible with full-time work.
Capstone project

Build it end to end

Your final project follows the real engineering workflow, step by step, reviewed by your tutor.

NIS2 applicability analysis
Determine how NIS2 applies to a company and map its obligations.
Statement of Applicability
Draft the ISO/IEC 27001 Statement of Applicability for an SME.
Ransomware continuity plan
Design a business continuity plan against ransomware and test it in a tabletop exercise.
FAIR risk quantification
Quantify a cyber risk scenario with FAIR to support investment decisions.
Master's Thesis
A cyber resilience plan for a target organisation, with risk analysis, continuity and investment plans, defended before a panel.
Career opportunities

Where this takes you

Information security managerBusiness continuity managerCybersecurity consultantManagement systems auditorTechnology risk analystCompliance officer
Admissions & scholarships

Requirements

  • A university degree in engineering, science or architecture, or equivalent demonstrable professional experience.
  • An internet connection and a computer capable of running the programme's software.
  • English sufficient to read technical standards.

Ready to start?

Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.

Apply now Scholarships
FAQ

Frequently asked questions

The programme totals 1,900 hours over 12–14 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.

You work with Microsoft Sentinel, Splunk, PILAR, Wazuh and Veeam, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.

A SEIUM Institute diploma, awarded on passing the continuous assessment and the Master's Thesis. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.

Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Ask about the recognition policy when you enrol.

A university degree in engineering, science or architecture (or equivalent professional experience), a computer able to run the software and English sufficient to read technical standards.

Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.

Keep exploring

Related programmes

See all in Business, Management & Technology Policy
Master's8,850 $

Master’s in Enterprise Risk and Insurance Engineering in Transport & Infrastructure

Online master's programme of 1,900 hours in enterprise risk and insurance engineering for transport and infrastructure: 12 modules covering enterprise risk management, risk quantification, insurance contracts,…

1900 hOnlineBusiness, Management & Technology Policy
Master's8,850 $

Master’s in Strategy & Operations Engineering

Online master's programme of 1,900 hours in strategy and operations engineering. 12 modules covering strategic analysis and deployment, operations design, production planning and S&OP, supply chain,…

1900 hOnlineBusiness, Management & Technology Policy
Master's8,850 $

Master’s in Technology and Data Contracting Engineering

Online master's programme of 1,900 hours in technology contracting and data engineering: 12 modules covering the legal framework of technology contracts, software development and licensing, SaaS,…

1900 hOnlineBusiness, Management & Technology Policy
Master’s in Enterprise Cyber-Resilience EngineeringEnrol
Related programmes

More in Business, Management & Technology Policy

Master’s in Aftermarket, After-Sales and Connected Services EngineeringView programme →Master’s in Public Policy & Regulation EngineeringView programme →Master’s in Energy Transition and Transport Decarbonisation Policy EngineeringView programme →Master’s in Fleet Management and Mobility-as-a-Service EngineeringView programme →Master’s in Finance, Investment & Risk EngineeringView programme →Master’s in Enterprise Risk and Insurance Engineering in Transport & InfrastructureView programme →

All Business, Management & Technology Policy programmes → · How to apply · Fees & financing · Scholarships

Scroll to Top
SEIUM – Institute of Advanced Engineering
Powered by  GDPR Cookie Compliance
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.