MSc

MSc UK SME Cyber and ICO-Facing Practice

ICO complaints, ransomware, and SME controls—not CISSP and not a hacking course.

Online or on campus

18 months180 creditsEnglish (dual pathway: London campus or tuition-free online; one academic standard)

MSc UK SME Cyber and ICO-Facing Practice

Overview

SMEs do not fail cyber because they lack a Silicon Valley SOC; they fail because backups were a myth, MFA was optional, and nobody owned the ICO clock. This MSc starts there. You will map a ransomware weekend for a ten-person firm, write a personal-data inventory that is not a lie, and brief a director without claiming a hacking qualification. Scottish and rUK SMEs sit in the cases: professional services in London, manufacturers in the Central Belt, care and education suppliers who hold children’s data. Dual-pathway students sit the same assessments. Faculty mark whether you can separate UK GDPR, PECR, and NIS-adjacent duties without dumping a US NIST poster as the whole answer. The degree is not CISSP, not a penetration-testing licence, not ICO employment. Offensive techniques are not taught as a curriculum outcome. Capstones must improve a control environment, not demonstrate intrusion. ICO-facing clocks, children’s data in small education suppliers, and invoice-fraud on a Friday afternoon are the British and UK cases, not a Silicon Valley breach memoir. Haverton University will not display NCSC, ICO, or CISSP marks. You will still be expected to brief a director in plain English about residual risk after MFA and backups are real rather than slideware. MSc UK SME Cyber and ICO-Facing Practice is taught as one award, not a list of unrelated modules. The published length is 18 months, and the credit total is 36. Students move from UK GDPR and PECR for SME Operators through UK GDPR and PECR for SME Operators; ICO Processes, SARs, and Complaint Clocks; NIS-Adjacent Duties without Operator Theatre; Identity, MFA, and Backup Reality; Phishing, Invoice Fraud, and Staff Culture; Cloud, Laptops, and Home Working in SMEs, and finish on Tabletop Exercises that Are Not LARP Hacking. Each course has a question, a method, and a submission. In this field, students map one named system, write a threat model, and specify the controls that would stop the most likely path. Reading is control catalogues, incident write-ups, and a short technical standard. The artefact a marker expects is a defensive design with a test plan and a statement of residual risk. The award is built so that a graduate can do the following in practice: Design proportionate SME controls and backup reality tests Run an ICO-facing complaint or SAR timeline as operations Write an incident log a director and an insurer can read Teaching assumes the student can read a source, attempt a problem before the seminar, and revise after feedback. Attendance at live seminars is part of the design. The capstone or final course must use the methods of the earlier courses; a project that ignores them does not pass. The pages for each course name the topics that are examined. Those topics are the syllabus. A brochure line is not a substitute for them.

Thirty-six credits: UK legal-operational cyber for SMEs, ICO-facing processes, incident and supplier risk, and a supervised controls capstone. Dual pathway. Explicit non-CISSP, non-offensive marketing.

Who This Programme Is For

SME operations, IT, and office managers who own cyber by default
DPO-adjacent staff in small organisations (not automatic DPO appointment)
Professional-services and care/education suppliers holding UK personal data
Consultants who refuse CISSP-theatre for ten-person firms

How you can study

Recommended

Study online

100% tuition-free online

Online tuition is free. Online examinations and certificates are 100% free and sponsored.

✦ Tuition: £0 / $0
✦ Examinations & certificates are 100% free & sponsored
✦ Learn from anywhere · Live online seminars

Apply online →

On-campus study

Study at our campus

Prefer to learn at our London campus? Campus tuition is published on each programme page. All examinations are 100% free of charge.

✦ Tuition: £9,500 / US$12,000/year
✦ Location: Du Cane Rd, London W12 0NN, United Kingdom
✦ Campus examinations are charged
✦ In-person seminars, library & student services

Apply for campus →

What You Will Learn

Design proportionate SME controls and backup reality tests
Run an ICO-facing complaint or SAR timeline as operations
Write an incident log a director and an insurer can read
Brief suppliers and staff without claiming CISSP
Refuse offensive-cyber framing in public descriptions of the award

Curriculum

Module 1: UK legal-operational baseline

Code	Course	Credits · hours
UOB701	UK GDPR and PECR for SME Operators UK GDPR and PECR for SME Operators (UOB701) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB701-M1 · The decision this degree is about, stated precisely UOB701-M2 · The concepts a master's analysis has to keep distinct UOB701-M3 · A case where the distinction changes the recommendation UOB701-M4 · A case where it does not UOB701-M5 · The source that fixes the terms UOB701-M6 · An assumption the rest of the award will rely on UOB701-M7 · What a foundation course must not pretend to settle UOB701-M8 · The submission: a concept and decision note. The assessed course is Threat modelling and attack paths.	15 · 150 h
UOB702	ICO Processes, SARs, and Complaint Clocks ICO Processes, SARs, and Complaint Clocks (UOB702) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB702-M1 · Assets, trust boundaries, and the adversary model — ICO Processes, SARs, and Complaint Clocks UOB702-M2 · Threat modelling and attack paths — ICO Processes, SARs, and Complaint Clocks UOB702-M3 · Identity, logging, and segmentation — ICO Processes, SARs, and Complaint Clocks UOB702-M4 · Detection, containment, and evidence — ICO Processes, SARs, and Complaint Clocks UOB702-M5 · Residual risk and what a control does not stop — ICO Processes, SARs, and Complaint Clocks UOB702-M6 · Defensive design, test plan, and after-action review — ICO Processes, SARs, and Complaint Clocks	15 · 150 h
UOB703	NIS-Adjacent Duties without Operator Theatre NIS-Adjacent Duties without Operator Theatre (UOB703) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB703-M1 · Assets, trust boundaries, and the adversary model — NIS-Adjacent Duties without Operator Theatre UOB703-M2 · Threat modelling and attack paths — NIS-Adjacent Duties without Operator Theatre UOB703-M3 · Identity, logging, and segmentation — NIS-Adjacent Duties without Operator Theatre UOB703-M4 · Detection, containment, and evidence — NIS-Adjacent Duties without Operator Theatre UOB703-M5 · Residual risk and what a control does not stop — NIS-Adjacent Duties without Operator Theatre UOB703-M6 · Defensive design, test plan, and after-action review — NIS-Adjacent Duties without Operator Theatre	15 · 150 h

Code

Course

Credits · hours

UOB701

UK GDPR and PECR for SME Operators

UK GDPR and PECR for SME Operators (UOB701) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB701-M1 · The decision this degree is about, stated precisely
UOB701-M2 · The concepts a master's analysis has to keep distinct
UOB701-M3 · A case where the distinction changes the recommendation
UOB701-M4 · A case where it does not
UOB701-M5 · The source that fixes the terms
UOB701-M6 · An assumption the rest of the award will rely on
UOB701-M7 · What a foundation course must not pretend to settle
UOB701-M8 · The submission: a concept and decision note. The assessed course is Threat modelling and attack paths.

15 · 150 h

UOB702

ICO Processes, SARs, and Complaint Clocks

ICO Processes, SARs, and Complaint Clocks (UOB702) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB702-M1 · Assets, trust boundaries, and the adversary model — ICO Processes, SARs, and Complaint Clocks
UOB702-M2 · Threat modelling and attack paths — ICO Processes, SARs, and Complaint Clocks
UOB702-M3 · Identity, logging, and segmentation — ICO Processes, SARs, and Complaint Clocks
UOB702-M4 · Detection, containment, and evidence — ICO Processes, SARs, and Complaint Clocks
UOB702-M5 · Residual risk and what a control does not stop — ICO Processes, SARs, and Complaint Clocks
UOB702-M6 · Defensive design, test plan, and after-action review — ICO Processes, SARs, and Complaint Clocks

15 · 150 h

UOB703

NIS-Adjacent Duties without Operator Theatre

NIS-Adjacent Duties without Operator Theatre (UOB703) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB703-M1 · Assets, trust boundaries, and the adversary model — NIS-Adjacent Duties without Operator Theatre
UOB703-M2 · Threat modelling and attack paths — NIS-Adjacent Duties without Operator Theatre
UOB703-M3 · Identity, logging, and segmentation — NIS-Adjacent Duties without Operator Theatre
UOB703-M4 · Detection, containment, and evidence — NIS-Adjacent Duties without Operator Theatre
UOB703-M5 · Residual risk and what a control does not stop — NIS-Adjacent Duties without Operator Theatre
UOB703-M6 · Defensive design, test plan, and after-action review — NIS-Adjacent Duties without Operator Theatre

15 · 150 h

Module 2: Controls that fit ten to two-hundred people

Code	Course	Credits · hours
UOB705	Identity, MFA, and Backup Reality Identity, MFA, and Backup Reality (UOB705) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB705-M1 · The indicator and the unit it counts UOB705-M2 · The source of the data and how it fails UOB705-M3 · Bias, missing data, or a definition that flatters the result UOB705-M4 · A comparison and the assumption inside it UOB705-M5 · A figure a marker can recompute UOB705-M6 · What the number must not be used to decide UOB705-M7 · How uncertainty is reported UOB705-M8 · The submission: a measurement note with the error. The assessed course is Vulnerability, testing, and evidence.	15 · 150 h
UOB706	Phishing, Invoice Fraud, and Staff Culture Phishing, Invoice Fraud, and Staff Culture (UOB706) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB706-M1 · Assets, trust boundaries, and the adversary model — Phishing, Invoice Fraud, and Staff Culture UOB706-M2 · Threat modelling and attack paths — Phishing, Invoice Fraud, and Staff Culture UOB706-M3 · Identity, logging, and segmentation — Phishing, Invoice Fraud, and Staff Culture UOB706-M4 · Detection, containment, and evidence — Phishing, Invoice Fraud, and Staff Culture UOB706-M5 · Residual risk and what a control does not stop — Phishing, Invoice Fraud, and Staff Culture UOB706-M6 · Defensive design, test plan, and after-action review — Phishing, Invoice Fraud, and Staff Culture	15 · 150 h
UOB707	Cloud, Laptops, and Home Working in SMEs Cloud, Laptops, and Home Working in SMEs (UOB707) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB707-M1 · Assets, trust boundaries, and the adversary model — Cloud, Laptops, and Home Working in SMEs UOB707-M2 · Threat modelling and attack paths — Cloud, Laptops, and Home Working in SMEs UOB707-M3 · Identity, logging, and segmentation — Cloud, Laptops, and Home Working in SMEs UOB707-M4 · Detection, containment, and evidence — Cloud, Laptops, and Home Working in SMEs UOB707-M5 · Residual risk and what a control does not stop — Cloud, Laptops, and Home Working in SMEs UOB707-M6 · Defensive design, test plan, and after-action review — Cloud, Laptops, and Home Working in SMEs	15 · 150 h

Code

Course

Credits · hours

UOB705

Identity, MFA, and Backup Reality

Identity, MFA, and Backup Reality (UOB705) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB705-M1 · The indicator and the unit it counts
UOB705-M2 · The source of the data and how it fails
UOB705-M3 · Bias, missing data, or a definition that flatters the result
UOB705-M4 · A comparison and the assumption inside it
UOB705-M5 · A figure a marker can recompute
UOB705-M6 · What the number must not be used to decide
UOB705-M7 · How uncertainty is reported
UOB705-M8 · The submission: a measurement note with the error. The assessed course is Vulnerability, testing, and evidence.

15 · 150 h

UOB706

Phishing, Invoice Fraud, and Staff Culture

Phishing, Invoice Fraud, and Staff Culture (UOB706) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB706-M1 · Assets, trust boundaries, and the adversary model — Phishing, Invoice Fraud, and Staff Culture
UOB706-M2 · Threat modelling and attack paths — Phishing, Invoice Fraud, and Staff Culture
UOB706-M3 · Identity, logging, and segmentation — Phishing, Invoice Fraud, and Staff Culture
UOB706-M4 · Detection, containment, and evidence — Phishing, Invoice Fraud, and Staff Culture
UOB706-M5 · Residual risk and what a control does not stop — Phishing, Invoice Fraud, and Staff Culture
UOB706-M6 · Defensive design, test plan, and after-action review — Phishing, Invoice Fraud, and Staff Culture

15 · 150 h

UOB707

Cloud, Laptops, and Home Working in SMEs

Cloud, Laptops, and Home Working in SMEs (UOB707) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB707-M1 · Assets, trust boundaries, and the adversary model — Cloud, Laptops, and Home Working in SMEs
UOB707-M2 · Threat modelling and attack paths — Cloud, Laptops, and Home Working in SMEs
UOB707-M3 · Identity, logging, and segmentation — Cloud, Laptops, and Home Working in SMEs
UOB707-M4 · Detection, containment, and evidence — Cloud, Laptops, and Home Working in SMEs
UOB707-M5 · Residual risk and what a control does not stop — Cloud, Laptops, and Home Working in SMEs
UOB707-M6 · Defensive design, test plan, and after-action review — Cloud, Laptops, and Home Working in SMEs

15 · 150 h

Module 3: Incidents and suppliers

Code	Course	Credits · hours
UOB709	Ransomware Weekends and Honest Downtime Ransomware Weekends and Honest Downtime (UOB709) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB709-M1 · Assets, trust boundaries, and the adversary model — Ransomware Weekends and Honest Downtime UOB709-M2 · Threat modelling and attack paths — Ransomware Weekends and Honest Downtime UOB709-M3 · Identity, logging, and segmentation — Ransomware Weekends and Honest Downtime UOB709-M4 · Detection, containment, and evidence — Ransomware Weekends and Honest Downtime UOB709-M5 · Residual risk and what a control does not stop — Ransomware Weekends and Honest Downtime UOB709-M6 · Defensive design, test plan, and after-action review — Ransomware Weekends and Honest Downtime	15 · 150 h
UOB710	Insurers, Solicitors, and Notification Decisions Insurers, Solicitors, and Notification Decisions (UOB710) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB710-M1 · Assets, trust boundaries, and the adversary model — Insurers, Solicitors, and Notification Decisions UOB710-M2 · Threat modelling and attack paths — Insurers, Solicitors, and Notification Decisions UOB710-M3 · Identity, logging, and segmentation — Insurers, Solicitors, and Notification Decisions UOB710-M4 · Detection, containment, and evidence — Insurers, Solicitors, and Notification Decisions UOB710-M5 · Residual risk and what a control does not stop — Insurers, Solicitors, and Notification Decisions UOB710-M6 · Defensive design, test plan, and after-action review — Insurers, Solicitors, and Notification Decisions	15 · 150 h
UOB711	Processor Contracts and Supply-Chain Weakest Links Processor Contracts and Supply-Chain Weakest Links (UOB711) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB711-M1 · Assets, trust boundaries, and the adversary model — Processor Contracts and Supply-Chain Weakest Links UOB711-M2 · Threat modelling and attack paths — Processor Contracts and Supply-Chain Weakest Links UOB711-M3 · Identity, logging, and segmentation — Processor Contracts and Supply-Chain Weakest Links UOB711-M4 · Detection, containment, and evidence — Processor Contracts and Supply-Chain Weakest Links UOB711-M5 · Residual risk and what a control does not stop — Processor Contracts and Supply-Chain Weakest Links UOB711-M6 · Defensive design, test plan, and after-action review — Processor Contracts and Supply-Chain Weakest Links	15 · 150 h

Code

Course

Credits · hours

UOB709

Ransomware Weekends and Honest Downtime

Ransomware Weekends and Honest Downtime (UOB709) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB709-M1 · Assets, trust boundaries, and the adversary model — Ransomware Weekends and Honest Downtime
UOB709-M2 · Threat modelling and attack paths — Ransomware Weekends and Honest Downtime
UOB709-M3 · Identity, logging, and segmentation — Ransomware Weekends and Honest Downtime
UOB709-M4 · Detection, containment, and evidence — Ransomware Weekends and Honest Downtime
UOB709-M5 · Residual risk and what a control does not stop — Ransomware Weekends and Honest Downtime
UOB709-M6 · Defensive design, test plan, and after-action review — Ransomware Weekends and Honest Downtime

15 · 150 h

UOB710

Insurers, Solicitors, and Notification Decisions

Insurers, Solicitors, and Notification Decisions (UOB710) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB710-M1 · Assets, trust boundaries, and the adversary model — Insurers, Solicitors, and Notification Decisions
UOB710-M2 · Threat modelling and attack paths — Insurers, Solicitors, and Notification Decisions
UOB710-M3 · Identity, logging, and segmentation — Insurers, Solicitors, and Notification Decisions
UOB710-M4 · Detection, containment, and evidence — Insurers, Solicitors, and Notification Decisions
UOB710-M5 · Residual risk and what a control does not stop — Insurers, Solicitors, and Notification Decisions
UOB710-M6 · Defensive design, test plan, and after-action review — Insurers, Solicitors, and Notification Decisions

15 · 150 h

UOB711

Processor Contracts and Supply-Chain Weakest Links

Processor Contracts and Supply-Chain Weakest Links (UOB711) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB711-M1 · Assets, trust boundaries, and the adversary model — Processor Contracts and Supply-Chain Weakest Links
UOB711-M2 · Threat modelling and attack paths — Processor Contracts and Supply-Chain Weakest Links
UOB711-M3 · Identity, logging, and segmentation — Processor Contracts and Supply-Chain Weakest Links
UOB711-M4 · Detection, containment, and evidence — Processor Contracts and Supply-Chain Weakest Links
UOB711-M5 · Residual risk and what a control does not stop — Processor Contracts and Supply-Chain Weakest Links
UOB711-M6 · Defensive design, test plan, and after-action review — Processor Contracts and Supply-Chain Weakest Links

15 · 150 h

Module 4: Capstone

Code	Course	Credits · hours
UOB713	British SME and Professional-Services Cases British SME and Professional-Services Cases (UOB713) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB713-M1 · Assets, trust boundaries, and the adversary model — British SME and Professional-Services Cases UOB713-M2 · Threat modelling and attack paths — British SME and Professional-Services Cases UOB713-M3 · Identity, logging, and segmentation — British SME and Professional-Services Cases UOB713-M4 · Detection, containment, and evidence — British SME and Professional-Services Cases UOB713-M5 · Residual risk and what a control does not stop — British SME and Professional-Services Cases UOB713-M6 · Defensive design, test plan, and after-action review — British SME and Professional-Services Cases	15 · 150 h
UOB714	Research Methods for Socio-Technical Controls Research Methods for Socio-Technical Controls (UOB714) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB714-M1 · Assets, trust boundaries, and the adversary model — Research Methods for Socio-Technical Controls UOB714-M2 · Threat modelling and attack paths — Research Methods for Socio-Technical Controls UOB714-M3 · Identity, logging, and segmentation — Research Methods for Socio-Technical Controls UOB714-M4 · Detection, containment, and evidence — Research Methods for Socio-Technical Controls UOB714-M5 · Residual risk and what a control does not stop — Research Methods for Socio-Technical Controls UOB714-M6 · Defensive design, test plan, and after-action review — Research Methods for Socio-Technical Controls	15 · 150 h
UOB715	Tabletop Exercises that Are Not LARP Hacking Tabletop Exercises that Are Not LARP Hacking (UOB715) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree. UOB715-M1 · Assets, trust boundaries, and the adversary model — Tabletop Exercises that Are Not LARP Hacking UOB715-M2 · Threat modelling and attack paths — Tabletop Exercises that Are Not LARP Hacking UOB715-M3 · Identity, logging, and segmentation — Tabletop Exercises that Are Not LARP Hacking UOB715-M4 · Detection, containment, and evidence — Tabletop Exercises that Are Not LARP Hacking UOB715-M5 · Residual risk and what a control does not stop — Tabletop Exercises that Are Not LARP Hacking UOB715-M6 · Defensive design, test plan, and after-action review — Tabletop Exercises that Are Not LARP Hacking	15 · 150 h

Code

Course

Credits · hours

UOB713

British SME and Professional-Services Cases

British SME and Professional-Services Cases (UOB713) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB713-M1 · Assets, trust boundaries, and the adversary model — British SME and Professional-Services Cases
UOB713-M2 · Threat modelling and attack paths — British SME and Professional-Services Cases
UOB713-M3 · Identity, logging, and segmentation — British SME and Professional-Services Cases
UOB713-M4 · Detection, containment, and evidence — British SME and Professional-Services Cases
UOB713-M5 · Residual risk and what a control does not stop — British SME and Professional-Services Cases
UOB713-M6 · Defensive design, test plan, and after-action review — British SME and Professional-Services Cases

15 · 150 h

UOB714

Research Methods for Socio-Technical Controls

Research Methods for Socio-Technical Controls (UOB714) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB714-M1 · Assets, trust boundaries, and the adversary model — Research Methods for Socio-Technical Controls
UOB714-M2 · Threat modelling and attack paths — Research Methods for Socio-Technical Controls
UOB714-M3 · Identity, logging, and segmentation — Research Methods for Socio-Technical Controls
UOB714-M4 · Detection, containment, and evidence — Research Methods for Socio-Technical Controls
UOB714-M5 · Residual risk and what a control does not stop — Research Methods for Socio-Technical Controls
UOB714-M6 · Defensive design, test plan, and after-action review — Research Methods for Socio-Technical Controls

15 · 150 h

UOB715

Tabletop Exercises that Are Not LARP Hacking

Tabletop Exercises that Are Not LARP Hacking (UOB715) is a course on MSc UK SME Cyber and ICO-Facing Practice. It carries 15 credits and 150 notional learning hours, at 10 hours per credit. The course is taught at master's level. Students compare a weaker method, judge the evidence, and state what the result does not show. The chapters are the syllabus. Each chapter is a class of work this course assesses. Preparation is the reading, dataset, or case for that chapter. Seminar time is spent on the decision, the calculation, or the draft. The student revises after feedback. A pass requires the method named in the chapters, evidence a marker can check, and a stated limit on what the result does not show. Haverton University teaches this course on the published route for this degree.

UOB715-M1 · Assets, trust boundaries, and the adversary model — Tabletop Exercises that Are Not LARP Hacking
UOB715-M2 · Threat modelling and attack paths — Tabletop Exercises that Are Not LARP Hacking
UOB715-M3 · Identity, logging, and segmentation — Tabletop Exercises that Are Not LARP Hacking
UOB715-M4 · Detection, containment, and evidence — Tabletop Exercises that Are Not LARP Hacking
UOB715-M5 · Residual risk and what a control does not stop — Tabletop Exercises that Are Not LARP Hacking
UOB715-M6 · Defensive design, test plan, and after-action review — Tabletop Exercises that Are Not LARP Hacking

15 · 150 h

Career Paths

SME cyber and compliance lead (academic MSc; not CISSP)
Office/operations manager with data-protection ownership
Incident coordinator in a small organisation
Supplier-risk officer
DPO support analyst (appointment not conferred)

Programme Highlights

SME and ICO facing, not generic cybersecurity MSc
No CISSP or NCSC logos
Non-offensive curriculum boundary
London or tuition-free online
Anonymised firm capstone

Assessment

Modules are assessed through a published mix of coursework, applied projects, and examinations. Exam windows are announced in advance so students in other time zones are not forced into overnight sittings. Alternative arrangements are available where documented.

Admission requirements

Academic entry

Bachelor's degree from a recognised institution (minimum 2:2 / GPA 2.5/4.0 or equivalent national scale)
Identity document for remote identity-checked assessment enrolment
Preferred: work in SME operations, IT support, or compliance; this is not a penetration-testing programme

English language

English proficiency: IELTS 5.5, TOEFL 46, or equivalent (waived for prior English-medium study). Dual-pathway applicants state London campus or tuition-free online as primary mode without changing academic standards. Gaelic/Scots programmes may require additional language evidence as stated on the programme page.

Documents

Statement of Purpose (500 words minimum) stating goals, professional context, and fit
Two academic or professional references with verifiable contact details
CV or résumé covering education and relevant work
Official transcripts (digital copies accepted at application; certified copies before award)

Programme questions

How long is the MSc UK SME Cyber and ICO-Facing Practice?

The published duration is 18 months. Teaching language: English (dual pathway: London campus or tuition-free online; one academic standard). Actual time-to-complete depends on mode and any recognised prior learning.

Can I study this from my country?

You may study this award fully online from your country, or — where published — on campus at Haverton. Online study does not require a student visa. Campus study may.

What does it cost?

Degree tuition for this award is published as £0 / tuition-free on the online pathway. All online degree examinations and certificates are 100% free and sponsored — the only cost for online study is the application fee. Campus tuition and campus examinations are charged separately. Check the Fees page for details.

What are the entry requirements?

Requirements are grouped on this page (academic, English, documents). Equivalent qualifications are considered. English may be waived after prior English-medium study.

How is the programme assessed?

Assessment is typically a mix of coursework, projects, and examinations. Doctoral awards include a thesis or dissertation and an oral examination. Details sit in the programme specification and module outlines.

Will this award be recognised where I live?

Recognition of the award for local employment, professional licence, or ministry attestation is decided by your employer or regulator. Haverton University publishes verification pages for certificates. We do not claim automatic equivalence in every country.

How do I apply?

Start an application on this website. Progress is saved from the first step. Admissions: admissions@haverton.org.

Recognised & Accredited

Ready to begin?MSc UK SME Cyber and ICO-Facing Practice

Start an application

Loading…