Critical National Infrastructure Protection Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Security Managers, Business Continuity Managers and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-SM-034

Before you join: Participants should have practical familiarity with security, risk, facilities, operations, business continuity or emergency management responsibilities.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Critical national infrastructure (CNI) operators must protect services whose disruption can affect public safety, economic activity, government functions and essential supply chains. Energy, water, transport, healthcare, telecommunications, financial services and digital infrastructure face combined physical, cyber, insider, environmental and supply-chain threats. Security managers need a defensible basis for deciding which assets and dependencies matter most, selecting proportionate controls, coordinating partners and sustaining services during disruption.

This course examines protection of critical infrastructure as a security management discipline. Participants learn to identify critical functions, map dependencies, assess threats and vulnerabilities, set risk treatment priorities and specify physical, personnel, information and operational technology security measures. The course connects security risk management with business continuity, emergency response, crisis communications and recovery. It uses ISO 31000, ISO 22301, IEC 62443 and the NIST Cybersecurity Framework to structure decisions, evidence and assurance.

Teaching combines short instructor briefings with sector-based cases, facilitated group analysis, incident simulations and structured application planning. Cases reflect realistic issues such as substation intrusion, ransomware affecting hospital systems, water treatment disruption, transport control-room failure and supplier compromise. Participants leave with a completed Critical Infrastructure Protection Plan, including an asset criticality model, dependency map, risk register, control improvement roadmap and incident coordination checklist. The five-day format provides approximately 32.5 contact hours, delivered in the classroom or live online.

The course suits security, resilience, facilities, risk, continuity and operational leaders responsible for essential services or major supporting suppliers. It is particularly relevant where security decisions require coordination between technical teams, public authorities, emergency services, regulators and senior management.

What you will be able to do

  • Classify critical services and assets using defined criticality criteria
  • Map infrastructure dependencies and identify single points of failure
  • Conduct threat, vulnerability and consequence assessments using ISO 31000
  • Specify proportionate physical, personnel, cyber and operational security controls
  • Develop a risk treatment plan with accountable owners and assurance measures
  • Integrate security arrangements with business continuity and emergency response plans
  • Coordinate incident information sharing with regulators, responders and infrastructure partners
  • Produce a Critical Infrastructure Protection Plan for a defined service

Benefits of attending

For you

  • Build a defensible method for prioritising protection investment
  • Recognise physical, cyber and dependency risks affecting essential services
  • Communicate infrastructure security priorities clearly to senior decision-makers
  • Apply recognised standards to security plans and assurance discussions
  • Prepare evidence-based recommendations after incidents, audits or regulator enquiries

For your organisation

  • Improves prioritisation of security expenditure against service disruption consequences
  • Reduces unmanaged dependencies between sites, suppliers, systems and public services
  • Strengthens coordination between security, operations, continuity and emergency teams
  • Produces clearer evidence for regulators, insurers, auditors and governing boards
  • Supports faster, more disciplined decisions during infrastructure security incidents

Course modules

10 modules over 5 days

Participants can define critical infrastructure protection requirements and assign clear governance responsibilities.

  • Criticality criteria linked to essential services, statutory duties and public confidence
  • National infrastructure functions, owners, regulators and emergency responder accountabilities
  • ISO 31000 principles applied to infrastructure security governance decisions
  • Security policy architecture covering objectives, roles, risk appetite and escalation routes
  • Three-lines model for board oversight, assurance and operational ownership
  • Defining protection, resilience, continuity and recovery performance requirements

Participants can identify critical functions, supporting assets and consequential dependencies.

  • Essential service mapping from customer outcomes to enabling assets
  • Critical asset registers using consequence, substitutability, recovery time and interdependency
  • Bow-tie analysis linking threats, preventive controls and recovery consequences
  • Dependency maps covering power, telecoms, data, transport, people and suppliers
  • Single points of failure identified through service-delivery chain analysis
  • Prioritising assets by public harm, economic loss and operational disruption

Participants can assess infrastructure security risks and select justified treatment priorities.

  • Threat assessment using intent, capability, opportunity and target attractiveness
  • Vulnerability assessment of perimeter, access, systems, processes and personnel
  • Risk scenarios expressed through source, event, consequence and existing controls
  • Likelihood and consequence scoring calibrated against defined risk criteria
  • Risk registers recording control gaps, owners, deadlines and residual risk
  • Treatment choices compared using avoidance, reduction, transfer and acceptance

Participants can specify layered physical security measures for critical sites and assets.

  • Defence-in-depth design using deter, detect, delay, respond and recover layers
  • Site zoning for public, controlled, restricted and high-security areas
  • Perimeter protection selected through adversary paths and response-time analysis
  • Access control rules for employees, visitors, contractors and delivery personnel
  • CCTV design principles covering detection, identification, retention and evidential quality
  • Security control rooms, alarm management and responder dispatch procedures

Participants can address cyber risks affecting industrial control systems and essential services.

  • NIST Cybersecurity Framework functions applied to essential service protection
  • IT and operational technology distinctions affecting ownership and risk decisions
  • IEC 62443 zones and conduits for industrial control system segmentation
  • Remote access governance for vendors, engineers and emergency support personnel
  • Ransomware scenarios assessed against safety, service continuity and recovery priorities
  • Patch management exceptions documented through operational risk acceptance processes

Participants can reduce insider, information and supplier security exposures.

  • Personnel security screening aligned with role sensitivity and access privileges
  • Insider threat indicators assessed without unsupported assumptions or discriminatory profiling
  • Need-to-know principles for drawings, credentials, schedules and incident records
  • Supplier due diligence covering security maturity, subcontractors and service dependencies
  • Contractual security requirements for notification, audit rights and incident cooperation
  • Offboarding controls removing access, assets, badges and sensitive information promptly

Participants can align protective security with continuity strategies and service recovery objectives.

  • ISO 22301 business impact analysis for critical service disruption
  • Recovery time objectives linked to security incident consequences and priorities
  • Continuity strategies for alternate sites, manual workarounds and reciprocal support
  • Redundancy decisions tested against common-mode failure and dependency risks
  • Recovery plans assigning authorities, resources, communications and restoration sequence
  • Post-incident review methods capturing corrective actions and control improvements

Participants can coordinate security incidents from initial reporting through recovery.

  • Incident classification thresholds triggering operational, executive and external escalation
  • Gold, Silver and Bronze command structures for multi-agency coordination
  • Initial incident logs recording facts, decisions, actions and evidence preservation
  • Crisis communications protocols for staff, customers, regulators and media
  • Joint operating picture built from verified intelligence and operational updates
  • Tabletop simulation principles for testing decisions, interfaces and recovery arrangements

Participants can establish practical coordination and assurance arrangements with external stakeholders.

  • Stakeholder mapping for regulators, police, emergency services and infrastructure partners
  • Memoranda of understanding defining roles, contacts, information and mutual assistance
  • Information-sharing protocols using sensitivity markings, handling rules and authorisation
  • Regulatory reporting triggers, evidence requirements and notification timeframes
  • Mutual aid arrangements for specialist personnel, equipment and alternate capacity
  • Assurance reporting linking risks, control status, incidents and improvement actions

Participants can assemble a measurable protection plan and implementation roadmap.

  • Critical Infrastructure Protection Plan structure, scope, assumptions and approvals
  • Control improvement roadmaps prioritised by risk reduction, cost and implementation effort
  • Key risk indicators monitoring threats, vulnerabilities, control failures and dependencies
  • Security assurance schedules using inspections, testing, audits and management review
  • Performance measures linking protection controls to service availability and recovery
  • Ninety-day application plan assigning actions, sponsors, milestones and evidence

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Critical Infrastructure Protection Plan template
  2. Essential-service asset criticality model
  3. Infrastructure dependency mapping template
  4. Security risk register and treatment plan
  5. Layered protective security control checklist
  6. Incident coordination and escalation checklist

Who should attend

  • Security Managers — responsible for protective security programmes and control assurance
  • Business Continuity Managers — aligning continuity arrangements with security risks and dependencies
  • Infrastructure Operations Managers — protecting essential services, sites and operational processes
  • Risk Managers — assessing infrastructure threats, consequences and risk treatment priorities
  • Facilities and Site Managers — managing access, perimeter, visitor and contractor security
  • Emergency Preparedness Officers — coordinating incident response with public authorities and responders

Skills and tools covered

Asset criticality analysisDependency mappingSecurity risk assessmentProtective security designIncident coordinationInfrastructure resilience planning

Tools and standards

ISO 31000, ISO 22301, IEC 62443, NIST Cybersecurity Framework

How the course runs

Training methodology

The course uses short briefings to introduce protection concepts, standards and decision methods, followed by guided case work based on essential-service scenarios. Participants analyse asset criticality, dependencies, threat information and control options in small groups. Facilitated simulations test incident coordination, escalation and communications under time pressure. Instructor feedback focuses on assumptions, evidence, accountability and practical implementation. Each participant develops an application plan that translates course methods into priorities for their own service, site or security programme.

Requirements and prerequisites

Participants should have practical familiarity with security, risk, facilities, operations, business continuity or emergency management responsibilities. They should understand basic concepts such as assets, threats, vulnerabilities, controls, incidents and risk ownership. Experience within an essential-service operator, major supplier, public authority or regulated sector is useful but not mandatory. No engineering qualification, cyber security certification, intelligence background or prior knowledge of ISO standards is required. The course does not require participants to disclose sensitive site plans, system details or classified information.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should understand basic security, risk, operations, facilities, continuity or emergency management concepts. Prior work in critical infrastructure is useful, but technical engineering or cyber security qualifications are not required.

Bring a general description of a service, site, asset group or security challenge you wish to improve. Do not bring classified material, sensitive network diagrams, restricted plans or personal data.

It is designed for managers and specialists with responsibility for protecting essential services, critical sites or major supporting suppliers. It also suits public-sector personnel who coordinate infrastructure resilience, emergency preparedness or regulatory oversight.

General security management courses commonly focus on corporate sites, personnel and loss prevention. This course concentrates on essential-service consequences, interdependencies, operational technology, multi-agency response and continuity of nationally important functions.

Participants can use the templates to review a priority service, create an asset criticality assessment and improve their risk register. The protection plan structure also supports discussions with operations, continuity, security suppliers and senior management.

The programme provides approximately 32.5 contact hours, normally from 08:30 to 16:30 each day. Time is divided between instructor input, case analysis, group work, simulations, discussion and individual application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Security Management

Security Management Advanced Enterprise Security Management Training Course 10 days · from USD 2,200 · next 16 Nov Security Management Asset Protection and Security Management Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Crowd Management and Control Training Course 10 days · from USD 2,200 · next 16 Nov Security Management Facilities Safety and Security Management Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Hostile Environment Awareness Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Physical Security Management Training Course 10 days · from USD 2,200 · next 16 Nov Security Management Security Policies and Procedures Training Course 10 days · from USD 2,200 · next 16 Nov Security Management Security Surveys and Risk Assessments Training Course 10 days · from USD 2,200 · next 16 Nov