MSc

MSc Cybersecurity & Privacy Engineering (Dual Track)

MSc Cybersecurity & Privacy Engineering — one admission, a shared core, two named specialisations.

Online only

24 months42 creditsEnglish (ES/PT/HI support hubs do not change the language of assessment unless a bilingual pathway is stated)

Begin your application Explore programme

MSc Cybersecurity & Privacy Engineering (Dual Track)

Overview

A double-path master's for engineers who must secure systems and build privacy in. Shared security core, then pathways in Cybersecurity (detection, response, governance) and Privacy Engineering (data protection by design, de-identification, compliance), with a capstone on a secure, privacy-preserving service. No offensive-security coursework. GlobalMind University delivers this award fully online across six world regions. There is no campus gate. Assessment is identity-checked and one academic standard applies to every student, in every time zone. This is an academic Master's award; where a field has a licensing or registration route, that remains a matter for your professional body or regulator. You will work through the material as a practitioner-researcher: applied methods, real or anonymised cases, and a supervised capstone or dissertation as the final component. Faculty mark whether you noticed the constraints a slide deck usually hides. MSc Cybersecurity & Privacy Engineering (Dual Track) is taught as one award, not a list of unrelated modules. The published length is 24 months, and the credit total is 42. Students move from Security Foundations & Threat Landscape through Security Foundations & Threat Landscape; Identity, Cryptography & Access Control; Data Protection Principles & Global Regimes; Research Methods & Identity-Checked Assessment; Defensive Architecture & Cloud Security; Detection Engineering & Security Operations, and finish on Dual-Track Capstone: Secure & Privacy-Preserving Service. Each course has a question, a method, and a submission. In this field, students map one named system, write a threat model, and specify the controls that would stop the most likely path. Reading is control catalogues, incident write-ups, and a short technical standard. The artefact a marker expects is a defensive design with a test plan and a statement of residual risk. The award is built so that a graduate can do the following in practice: Design proportionate security controls for a real organisation Run detection and incident response without heroics or blame Translate technical risk into board-level decisions and reporting Teaching assumes the student can read a source, attempt a problem before the seminar, and revise after feedback. Attendance at live seminars is part of the design. The capstone or final course must use the methods of the earlier courses; a project that ignores them does not pass. The pages for each course name the topics that are examined. Those topics are the syllabus. A brochure line is not a substitute for them.

The programme carries 42 credits across four assessed modules. Delivery is tuition-free aside from the examination fee. Transcripts use letter grades and a GPA scale consistent with GlobalMind University awards. No professional-body logo is used in marketing to imply endorsement.

Who This Programme Is For

IT and infrastructure staff moving into security
Risk, audit and compliance professionals
Managers accountable for security posture
Graduates in computing or a related field

How you can study

Digital only

Study online

100% tuition-free online

Tuition is free. Examinations are free. There is no exam fee. Study from anywhere in the world.

✦ Tuition: £0 / $0
✦ Examinations are free. There is no exam fee.
✦ Learn from anywhere · Live online seminars

Apply online →

What You Will Learn

Design proportionate security controls for a real organisation
Run detection and incident response without heroics or blame
Translate technical risk into board-level decisions and reporting
Meet regulatory and privacy obligations without security theatre

Curriculum

Term 1 — Shared Security & Privacy Core

Code	Course	Credits · hours
GMCP701	Security Foundations & Threat Landscape Security Foundations & Threat Landscape (GMCP701) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Security Foundations & Threat Landscape as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP701-M1 · Assets, trust boundaries, and the adversary model — Security Foundations & Threat Landscape GMCP701-M2 · Threat modelling and attack paths — Security Foundations & Threat Landscape GMCP701-M3 · Identity, logging, and segmentation — Security Foundations & Threat Landscape GMCP701-M4 · Detection, containment, and evidence — Security Foundations & Threat Landscape GMCP701-M5 · Residual risk and what a control does not stop — Security Foundations & Threat Landscape GMCP701-M6 · Defensive design, test plan, and after-action review — Security Foundations & Threat Landscape	3 · 30 h
GMCP702	Identity, Cryptography & Access Control Identity, Cryptography & Access Control (GMCP702) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Identity, Cryptography & Access Control as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP702-M1 · Assets, trust boundaries, and the adversary model — Identity, Cryptography & Access Control GMCP702-M2 · Threat modelling and attack paths — Identity, Cryptography & Access Control GMCP702-M3 · Identity, logging, and segmentation — Identity, Cryptography & Access Control GMCP702-M4 · Detection, containment, and evidence — Identity, Cryptography & Access Control GMCP702-M5 · Residual risk and what a control does not stop — Identity, Cryptography & Access Control GMCP702-M6 · Defensive design, test plan, and after-action review — Identity, Cryptography & Access Control	3 · 30 h
GMCP703	Data Protection Principles & Global Regimes Data Protection Principles & Global Regimes (GMCP703) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Data Protection Principles & Global Regimes as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP703-M1 · Assets, trust boundaries, and the adversary model — Data Protection Principles & Global Regimes GMCP703-M2 · Threat modelling and attack paths — Data Protection Principles & Global Regimes GMCP703-M3 · Identity, logging, and segmentation — Data Protection Principles & Global Regimes GMCP703-M4 · Detection, containment, and evidence — Data Protection Principles & Global Regimes GMCP703-M5 · Residual risk and what a control does not stop — Data Protection Principles & Global Regimes GMCP703-M6 · Defensive design, test plan, and after-action review — Data Protection Principles & Global Regimes	3 · 30 h
GMCP704	Research Methods & Identity-Checked Assessment Research Methods & Identity-Checked Assessment (GMCP704) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Research Methods & Identity-Checked Assessment as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP704-M1 · Assets, trust boundaries, and the adversary model — Research Methods & Identity-Checked Assessment GMCP704-M2 · Threat modelling and attack paths — Research Methods & Identity-Checked Assessment GMCP704-M3 · Identity, logging, and segmentation — Research Methods & Identity-Checked Assessment GMCP704-M4 · Detection, containment, and evidence — Research Methods & Identity-Checked Assessment GMCP704-M5 · Residual risk and what a control does not stop — Research Methods & Identity-Checked Assessment GMCP704-M6 · Defensive design, test plan, and after-action review — Research Methods & Identity-Checked Assessment	3 · 30 h

Term 2 — Pathway A: Cybersecurity

Code	Course	Credits · hours
GMCP705	Defensive Architecture & Cloud Security Defensive Architecture & Cloud Security (GMCP705) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Defensive Architecture & Cloud Security as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP705-M1 · Assets, trust boundaries, and the adversary model — Defensive Architecture & Cloud Security GMCP705-M2 · Threat modelling and attack paths — Defensive Architecture & Cloud Security GMCP705-M3 · Identity, logging, and segmentation — Defensive Architecture & Cloud Security GMCP705-M4 · Detection, containment, and evidence — Defensive Architecture & Cloud Security GMCP705-M5 · Residual risk and what a control does not stop — Defensive Architecture & Cloud Security GMCP705-M6 · Defensive design, test plan, and after-action review — Defensive Architecture & Cloud Security	3 · 30 h
GMCP706	Detection Engineering & Security Operations Detection Engineering & Security Operations (GMCP706) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Detection Engineering & Security Operations as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP706-M1 · Assets, trust boundaries, and the adversary model — Detection Engineering & Security Operations GMCP706-M2 · Threat modelling and attack paths — Detection Engineering & Security Operations GMCP706-M3 · Identity, logging, and segmentation — Detection Engineering & Security Operations GMCP706-M4 · Detection, containment, and evidence — Detection Engineering & Security Operations GMCP706-M5 · Residual risk and what a control does not stop — Detection Engineering & Security Operations GMCP706-M6 · Defensive design, test plan, and after-action review — Detection Engineering & Security Operations	3 · 30 h
GMCP707	Incident Response & Forensics Incident Response & Forensics (GMCP707) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Incident Response & Forensics as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP707-M1 · Assets, trust boundaries, and the adversary model — Incident Response & Forensics GMCP707-M2 · Threat modelling and attack paths — Incident Response & Forensics GMCP707-M3 · Identity, logging, and segmentation — Incident Response & Forensics GMCP707-M4 · Detection, containment, and evidence — Incident Response & Forensics GMCP707-M5 · Residual risk and what a control does not stop — Incident Response & Forensics GMCP707-M6 · Defensive design, test plan, and after-action review — Incident Response & Forensics	3 · 30 h
GMCP708	Security Governance, Risk & Compliance Security Governance, Risk & Compliance (GMCP708) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Security Governance, Risk & Compliance as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP708-M1 · Assets, trust boundaries, and the adversary model — Security Governance, Risk & Compliance GMCP708-M2 · Threat modelling and attack paths — Security Governance, Risk & Compliance GMCP708-M3 · Identity, logging, and segmentation — Security Governance, Risk & Compliance GMCP708-M4 · Detection, containment, and evidence — Security Governance, Risk & Compliance GMCP708-M5 · Residual risk and what a control does not stop — Security Governance, Risk & Compliance GMCP708-M6 · Defensive design, test plan, and after-action review — Security Governance, Risk & Compliance	3 · 30 h

Term 3 — Pathway B: Privacy Engineering

Code	Course	Credits · hours
GMCP709	Privacy by Design & Data Minimisation Privacy by Design & Data Minimisation (GMCP709) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Privacy by Design & Data Minimisation as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP709-M1 · Assets, trust boundaries, and the adversary model — Privacy by Design & Data Minimisation GMCP709-M2 · Threat modelling and attack paths — Privacy by Design & Data Minimisation GMCP709-M3 · Identity, logging, and segmentation — Privacy by Design & Data Minimisation GMCP709-M4 · Detection, containment, and evidence — Privacy by Design & Data Minimisation GMCP709-M5 · Residual risk and what a control does not stop — Privacy by Design & Data Minimisation GMCP709-M6 · Defensive design, test plan, and after-action review — Privacy by Design & Data Minimisation	3 · 30 h
GMCP710	De-identification, Differential Privacy & Analytics De-identification, Differential Privacy & Analytics (GMCP710) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using De-identification, Differential Privacy & Analytics as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP710-M1 · Assets, trust boundaries, and the adversary model — De-identification, Differential Privacy & Analytics GMCP710-M2 · Threat modelling and attack paths — De-identification, Differential Privacy & Analytics GMCP710-M3 · Identity, logging, and segmentation — De-identification, Differential Privacy & Analytics GMCP710-M4 · Detection, containment, and evidence — De-identification, Differential Privacy & Analytics GMCP710-M5 · Residual risk and what a control does not stop — De-identification, Differential Privacy & Analytics GMCP710-M6 · Defensive design, test plan, and after-action review — De-identification, Differential Privacy & Analytics	3 · 30 h
GMCP711	Consent, DSARs & Cross-Border Transfers Consent, DSARs & Cross-Border Transfers (GMCP711) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Consent, DSARs & Cross-Border Transfers as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP711-M1 · Assets, trust boundaries, and the adversary model — Consent, DSARs & Cross-Border Transfers GMCP711-M2 · Threat modelling and attack paths — Consent, DSARs & Cross-Border Transfers GMCP711-M3 · Identity, logging, and segmentation — Consent, DSARs & Cross-Border Transfers GMCP711-M4 · Detection, containment, and evidence — Consent, DSARs & Cross-Border Transfers GMCP711-M5 · Residual risk and what a control does not stop — Consent, DSARs & Cross-Border Transfers GMCP711-M6 · Defensive design, test plan, and after-action review — Consent, DSARs & Cross-Border Transfers	3 · 30 h

Code

Course

Credits · hours

GMCP709

Privacy by Design & Data Minimisation

Privacy by Design & Data Minimisation (GMCP709) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Privacy by Design & Data Minimisation as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

GMCP709-M1 · Assets, trust boundaries, and the adversary model — Privacy by Design & Data Minimisation
GMCP709-M2 · Threat modelling and attack paths — Privacy by Design & Data Minimisation
GMCP709-M3 · Identity, logging, and segmentation — Privacy by Design & Data Minimisation
GMCP709-M4 · Detection, containment, and evidence — Privacy by Design & Data Minimisation
GMCP709-M5 · Residual risk and what a control does not stop — Privacy by Design & Data Minimisation
GMCP709-M6 · Defensive design, test plan, and after-action review — Privacy by Design & Data Minimisation

3 · 30 h

GMCP710

De-identification, Differential Privacy & Analytics

De-identification, Differential Privacy & Analytics (GMCP710) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using De-identification, Differential Privacy & Analytics as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

GMCP710-M1 · Assets, trust boundaries, and the adversary model — De-identification, Differential Privacy & Analytics
GMCP710-M2 · Threat modelling and attack paths — De-identification, Differential Privacy & Analytics
GMCP710-M3 · Identity, logging, and segmentation — De-identification, Differential Privacy & Analytics
GMCP710-M4 · Detection, containment, and evidence — De-identification, Differential Privacy & Analytics
GMCP710-M5 · Residual risk and what a control does not stop — De-identification, Differential Privacy & Analytics
GMCP710-M6 · Defensive design, test plan, and after-action review — De-identification, Differential Privacy & Analytics

3 · 30 h

GMCP711

Consent, DSARs & Cross-Border Transfers

Consent, DSARs & Cross-Border Transfers (GMCP711) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Consent, DSARs & Cross-Border Transfers as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

GMCP711-M1 · Assets, trust boundaries, and the adversary model — Consent, DSARs & Cross-Border Transfers
GMCP711-M2 · Threat modelling and attack paths — Consent, DSARs & Cross-Border Transfers
GMCP711-M3 · Identity, logging, and segmentation — Consent, DSARs & Cross-Border Transfers
GMCP711-M4 · Detection, containment, and evidence — Consent, DSARs & Cross-Border Transfers
GMCP711-M5 · Residual risk and what a control does not stop — Consent, DSARs & Cross-Border Transfers
GMCP711-M6 · Defensive design, test plan, and after-action review — Consent, DSARs & Cross-Border Transfers

3 · 30 h

Term 4 — Integration & Dual-Track Capstone

Code	Course	Credits · hours
GMCP712	Integrating Two Disciplines in Practice Integrating Two Disciplines in Practice (GMCP712) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Integrating Two Disciplines in Practice as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP712-M1 · Assets, trust boundaries, and the adversary model — Integrating Two Disciplines in Practice GMCP712-M2 · Threat modelling and attack paths — Integrating Two Disciplines in Practice GMCP712-M3 · Identity, logging, and segmentation — Integrating Two Disciplines in Practice GMCP712-M4 · Detection, containment, and evidence — Integrating Two Disciplines in Practice GMCP712-M5 · Residual risk and what a control does not stop — Integrating Two Disciplines in Practice GMCP712-M6 · Defensive design, test plan, and after-action review — Integrating Two Disciplines in Practice	3 · 30 h
GMCP713	Dual-Track Capstone: Secure & Privacy-Preserving Service Dual-Track Capstone: Secure & Privacy-Preserving Service (GMCP713) is a 6-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 60 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Dual-Track Capstone: Secure & Privacy-Preserving Service as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. GMCP713-M1 · Assets, trust boundaries, and the adversary model — Dual-Track Capstone: Secure & Privacy-Preserving Service GMCP713-M2 · Threat modelling and attack paths — Dual-Track Capstone: Secure & Privacy-Preserving Service GMCP713-M3 · Identity, logging, and segmentation — Dual-Track Capstone: Secure & Privacy-Preserving Service GMCP713-M4 · Detection, containment, and evidence — Dual-Track Capstone: Secure & Privacy-Preserving Service GMCP713-M5 · Residual risk and what a control does not stop — Dual-Track Capstone: Secure & Privacy-Preserving Service GMCP713-M6 · Defensive design, test plan, and after-action review — Dual-Track Capstone: Secure & Privacy-Preserving Service	6 · 60 h

Code

Course

Credits · hours

GMCP712

Integrating Two Disciplines in Practice

Integrating Two Disciplines in Practice (GMCP712) is a 3-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Integrating Two Disciplines in Practice as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

GMCP712-M1 · Assets, trust boundaries, and the adversary model — Integrating Two Disciplines in Practice
GMCP712-M2 · Threat modelling and attack paths — Integrating Two Disciplines in Practice
GMCP712-M3 · Identity, logging, and segmentation — Integrating Two Disciplines in Practice
GMCP712-M4 · Detection, containment, and evidence — Integrating Two Disciplines in Practice
GMCP712-M5 · Residual risk and what a control does not stop — Integrating Two Disciplines in Practice
GMCP712-M6 · Defensive design, test plan, and after-action review — Integrating Two Disciplines in Practice

3 · 30 h

GMCP713

Dual-Track Capstone: Secure & Privacy-Preserving Service

Dual-Track Capstone: Secure & Privacy-Preserving Service (GMCP713) is a 6-credit course on MSc Cybersecurity & Privacy Engineering (Dual Track), with 60 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Dual-Track Capstone: Secure & Privacy-Preserving Service as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

GMCP713-M1 · Assets, trust boundaries, and the adversary model — Dual-Track Capstone: Secure & Privacy-Preserving Service
GMCP713-M2 · Threat modelling and attack paths — Dual-Track Capstone: Secure & Privacy-Preserving Service
GMCP713-M3 · Identity, logging, and segmentation — Dual-Track Capstone: Secure & Privacy-Preserving Service
GMCP713-M4 · Detection, containment, and evidence — Dual-Track Capstone: Secure & Privacy-Preserving Service
GMCP713-M5 · Residual risk and what a control does not stop — Dual-Track Capstone: Secure & Privacy-Preserving Service
GMCP713-M6 · Defensive design, test plan, and after-action review — Dual-Track Capstone: Secure & Privacy-Preserving Service

6 · 60 h

Career Paths

Security analyst / SOC analyst
Security engineer or architect
GRC and security-governance roles
Incident responder
Security manager or CISO track

Programme Highlights

Defensive focus — no offensive-security coursework
Detection engineering, incident response and governance
Board-facing risk communication
A capstone producing a defensible security programme

Assessment

Modules are assessed through a published mix of coursework, applied projects, and examinations. Exam windows are announced in advance so students in other time zones are not forced into overnight sittings. Alternative arrangements are available where documented.

Admission requirements

Academic entry

Bachelor's degree from a recognised institution (minimum 2:2 / GPA 2.5/4.0 or an equivalent national scale)
Identity document for remote identity-checked assessment enrolment

English language

English proficiency: IELTS 5.5, TOEFL 46 or equivalent (waived for prior English-medium study). State your primary study mode without changing the academic standard.

Documents

Statement of Purpose (500 words minimum) covering goals, professional context and fit
Two academic or professional references with verifiable contact details
CV or résumé covering education and relevant work
Official transcripts (digital copies accepted at application; certified copies before award)

Programme questions

How long is the MSc Cybersecurity & Privacy Engineering (Dual Track)?

The published duration is 24 months. Teaching language: English (ES/PT/HI support hubs do not change the language of assessment unless a bilingual pathway is stated). Actual time-to-complete depends on mode and any recognised prior learning.

Can I study this from my country?

This is a fully online award. You study from your country. No student visa and no campus relocation are required.

What does it cost?

Degree tuition for this award is published as £0 / tuition-free on the online pathway. Examination or administrative fees may apply at checkout — never an annual tuition invoice. Check the Fees page for any extras.

What are the entry requirements?

Requirements are grouped on this page (academic, English, documents). Equivalent qualifications are considered. English may be waived after prior English-medium study.

How is the programme assessed?

Assessment is typically a mix of coursework, projects, and examinations. Doctoral awards include a thesis or dissertation and an oral examination. Details sit in the programme specification and module outlines.

Will this award be recognised where I live?

Recognition of the award for local employment, professional licence, or ministry attestation is decided by your employer or regulator. GlobalMind University publishes verification pages for certificates. We do not claim automatic equivalence in every country.

How do I apply?

Start an application on this website. Progress is saved from the first step. Admissions: admissions@gmuniv.com.

Recognised & Accredited

Ready to begin?MSc Cybersecurity & Privacy Engineering (Dual Track)

Apply now