When the main subject areas are combined, they create an effective risk management program to establish the foundation to protecting information and assets. The specific focus of this course doesn’t allow covering certain topics. Subject areas related to risk––such as threat and vulnerability management, as well as information security controls––simply cannot be covered within the scope of this course.