Skip to content

CourseOutline

MBA from AI rough notes

THE CISO-MBA: COURSE CATALOG

BLOCK I — THE MBA CORE (the standard first-year canon, each taught through a security-executive lens)

  1. Financial Accounting MBA content: reading income statements, balance sheets, cash flow statements CISO customization: security as a line item — how breaches hit financials (material incident disclosures per SEC rules), how auditors treat IT controls, SOX 404 Free resources: Khan Academy financial accounting; MIT OCW 15.501 Deliverable: pick a public company, read their 10-K, find every security-related disclosure and write a 2-page memo on how security affected their financials

  2. Corporate Finance and Budgeting MBA content: NPV, ROI, CAPM, capital budgeting, cost of capital CISO customization: building and defending a security budget, cost-benefit analysis for controls, security insurance, ransomware payment decisions, SANS SEC405 (Business Finance Essentials) covers exactly this Free resources: Khan Academy finance and capital markets; Aswath Damodaran's free NYU valuation lectures (online, all public) Deliverable: a full annual security budget for a 2,000-person company, with an ROI justification for each major line

  3. Marketing MBA content: segmentation, positioning, the 4 Ps, buyer psychology CISO customization: this is the CISO's secret weapon course — you "market" to three audiences: the board (buy-in for budget), employees (security awareness behavior change), and customers (trust as a selling point). Awareness campaigns ARE marketing campaigns. Free resources: Coursera Wharton "Introduction to Marketing" (audit free); "Influence" by Cialdini Deliverable: a security awareness campaign designed like a real marketing campaign — target segments, message, channels, and metrics for behavior change

  4. Microeconomics and Strategy MBA content: supply and demand, game theory, Porter's Five Forces, competitive advantage CISO customization: threat modeling as economics — attackers are rational actors who respond to incentives; security as competitive advantage (why AWS and banks sell trust); game theory applied to attacker/defender dynamics Free resources: Khan Academy economics; MIT OCW 15.010 or Yale's open microeconomics course; Porter's "Competitive Strategy" Deliverable: a threat actor economic analysis — what does an attack cost the attacker, what's their ROI, which controls change their calculus

  5. Operations Management MBA content: process design, queues, capacity planning, quality management, supply chain CISO customization: the security program IS an operation — SOC staffing models, incident response as a process, vulnerability management pipelines, SLAs. Supply chain becomes third-party/vendor risk (SolarWinds is a supply chain operations failure, not a tooling failure). Free resources: MIT OCW 15.761; Coursera Wharton operations (audit free) Deliverable: a process map of a vuln management program from scan to fix, with cycle time metrics and bottlenecks

  6. Organizational Behavior and Leadership MBA content: motivation, team dynamics, power and influence, managing up CISO customization: influencing without authority (the CISO usually owns risk but controls almost nothing), building the security team, handling the org's immune response to change, incident command psychology Free resources: Coursera "Organizational Analysis" (Stanford, audit free); "The Effective Executive" (Drucker); "Extreme Ownership" Deliverable: an org design for a security function — roles, reporting lines, where CISO reports and why it matters

  7. Business Law, Ethics, and Negotiation MBA content: contracts, liability, regulatory regimes, bargaining CISO customization: breach notification law, GDPR/CCPA, sector regs (HIPAA/SOX/PCI — pick your target industry), vendor contract security clauses, negotiating with auditors, regulators, and (during incidents) cyber insurers and law enforcement Free resources: any state university's open business law text; Harvard's Program on Negotiation free articles Deliverable: a playbook for the legal first 48 hours of a breach

  8. Data and Statistics (MBA "quant") MBA content: regression, distributions, decision analysis, dashboards CISO customization: metrics that matter — risk quantification (FAIR — this is your anchor text), measuring control effectiveness, board-level KPIs vs operational metrics, why risk heat maps lie Free resources: Khan Academy statistics; FAIR book (Jones, "Measuring and ManagingInformation Risk") Deliverable: a quantified risk register with dollar-value exposures instead of red/yellow/green

BLOCK II — CISO ELECTIVES (second-year specialization)

  1. IT and Vendor Management: contracting, SLAs, TCO analysis — Deliverable: a real RFP evaluation for a SIEM
  2. Corporate Governance: board structure, audit committees, director duties — Deliverable: a board presentation deck on a major security investment
  3. Crisis Management and Communications: PR side of breaches — Deliverable: holding statements for a breach scenario, drafted before it happens
  4. Entrepreneurship (optional but valuable): how startups and VCs evaluate security — useful if you ever want a CISO-in-residence or advisory path

CAPSTONE

Write a complete security program for a real or fictional mid-size company: strategy doc, budget, org chart, quantified risk register, board deck, and a 91-day onboarding plan. Andy Ellis's free "How to CISO" volumes (howtociso.com) are the best template for this. This becomes your portfolio.