Diploma in Cybersecurity Operations
Every organisation Uganda is digitising creates a security problem it cannot yet staff: banks, telecoms, government systems and the donor funded programmes all report security incidents against a near empty cybersecurity workforce.
Occupational profile
What you'll be paid to do
Every organisation Uganda is digitising creates a security problem it cannot yet staff: banks, telecoms, government systems and the donor funded programmes all report security incidents against a near empty cybersecurity workforce.
The region imports the skill at expatriate rates and trains nowhere near enough locally.
FC-D06 trains the security operations analyst the SOC, the bank and the regulator actually hire: monitoring, incident response, The graduate works as any of the following, in a sector that cannot fill its vacancies: government, SOC monthly; the market's providers premium entry analyst consultancies, audit firms monthly
| Occupation | Where the work is | Starting earnings, observed 2026 |
|---|---|---|
| Security operations analyst | Banks, telecoms, government, SOC providers | UGX 1,200,000 to 2,500,000 monthly; the market's premium entry |
| Incident response analyst | Security firms, large organisations, own practice | UGX 1,000,000 to 2,200,000 monthly |
| Digital forensics technician | Law enforcement technical units, legal firms, investigations | UGX 1,000,000 to 2,000,000 monthly |
| Security governance analyst | Regulated sectors, consultancies, audit firms | UGX 900,000 to 1,800,000 monthly |
The 90-Day Promise
From certification to income, stated concretely
Day Pathway Named employer categories with which the College holds or is concluding placement and hiring partnerships: banks and fintechs; telecoms; firms; law enforcement digital investigation units; and the College's own cohort's year two training, each offering at least two placements.
The ninety day pathway from certification to income:
Day 0: graduation with the Capability Transcript, the mentor's reference, the live SOC record and a penetration test report as portfolio.
Days 1 to 30: employed route: three arranged interviews in a market where vacancies exceed candidates.
Day 0: graduation with the Capability Transcript, the mentor's reference, the live SOC record and a penetration test report as portfolio.
Days 1 to 30: employed route: three arranged interviews in a market where vacancies exceed candidates. Self employed route: the practice's engagements continue; the mentor reviews month one.
Days 31 to 90: employed route: probation support from the practice tutor. Self employed route: referral listing for partner overflow assessments and
Measurement: employment or trading status recorded at day 90 and published in the annual outcomes report, per Part Two, section 2.9.
Programme structure
Every module, with its arithmetic
One credit unit equals ten notional learning hours. 240 credit units, 2400 notional hours: 670 contact, 1340 practical and 330 industrial hours, so practical and industrial hours are 70 per cent of the programme.
h g and al p and ty and and ce s One and and for ons Two ent Practical and industrial hours together are 1670 of 2400 notional hours, 70 per cent, meeting the hands on test.
Semester 1
| Code | Module | CU | Contact h | Practical h | Industry h |
|---|---|---|---|---|---|
| CSO101 | Foundations of Cybersecurity and NetworkingEverything else stands on this: networks fluently read, the threat landscape honestly described, and the security mindset established before any tool is | 14 | 55 | 85 | 0 |
| CSO102 | Security Monitoring and Log AnalysisDefence begins with sight: the learner instruments environments, collects logs and finds the signal in the noise, the daily work of the security operations centre the diploma trains for. | 14 | 50 | 90 | 0 |
| CSO103 | Network Security and Firewall ManagementThe perimeter protected by someone who has built it, broken it and rebuilt it: the learner configures, manages and tests network security controls at operator depth. | 12 | 40 | 80 | 0 |
| PRO201 | Professional Communication and Team LeadershipDiploma holders supervise, present and negotiate. This module upgrades the certificate's communication craft into professional leadership: briefing teams, writing for decision makers and representing an employer. | 6 | 30 | 15 | 0 |
Semester 2
| Code | Module | CU | Contact h | Practical h | Industry h |
|---|---|---|---|---|---|
| CSO104 | Endpoint Security and Vulnerability ManagementThe endpoint is where the attacker lands: hardening, patching, endpoint detection, and the vulnerability management cycle that keeps the estate from falling behind. | 12 | 40 | 80 | 0 |
| CSO105 | Identity, Access and Data SecurityMost breaches begin with an identity: the learner designs, implements and audits identity and access controls, and protects the data those controls guard. | 10 | 35 | 65 | 0 |
| CSO106 | Incident Response and Digital Forensics BasicsWhen the alarm fires, method matters: the learner runs incident response from detection through containment, eradication and recovery, collecting evidence that survives a court challenge. | 14 | 45 | 95 | 0 |
| CSO107 | Security Governance, Risk and ComplianceSecurity without governance is heroism: the learner builds the policies, risk assessments and compliance evidence that make an organisation's security defensible to regulators, auditors and boards. | 12 | 45 | 75 | 0 |
| SPND601AI spine | AI and Data in Security OperationsThe spine at diploma depth: AI in the SOC, threat intelligence analytics, and the adversarial AI landscape the next generation of analysts will fight. | 14 | 50 | 90 | 0 |
| ITRD601 | Industrial Training OneTen assessed weeks in a security operations or IT environment at the end of year one, under the Part Two policy. | 16 | 0 | 10 | 150 |
Semester 3
| Code | Module | CU | Contact h | Practical h | Industry h |
|---|---|---|---|---|---|
| CSO201 | Security Operations Centre Practice | 22 | 60 | 160 | 0 |
| CSO202 | Cloud and Application SecurityThe attack surface has moved to the cloud and the application layer: the learner secures the environments Ugandan organisations increasingly run on. | 16 | 50 | 110 | 0 |
| CSO203 | Digital Forensics and Evidence for Investigations | 16 | 50 | 110 | 0 |
Semester 4
| Code | Module | CU | Contact h | Practical h | Industry h |
|---|---|---|---|---|---|
| CSO204 | Penetration Testing FundamentalsYear two forensics at depth: the learner conducts investigations that produce evidence admissible in Ugandan proceedings, working with law enforcement realities and the rights of the investigated. | 14 | 40 | 100 | 0 |
| SPN102AI spine | Digital Work and Platform IncomeThe shortest module with the fastest payback: how a technician finds customers, prices work, invoices and gets paid through digital channels. | 4 | 15 | 20 | 0 |
| ENT201 | Enterprise Development and ManagementThe diploma's business module: not just starting an enterprise but running one: people, money, contracts, compliance and growth, taught through the learner's own trade. | 10 | 45 | 45 | 0 |
| ITRD602 | Industrial Training TwoTwelve assessed weeks in year two in a security operation with a host project, under the Part Two policy. | 20 | 0 | 10 | 180 |
| EXPD601 | Exit Venture or Employment ProjectThe closing argument, specified in section 11: a security services practice trading or a complete organisation security project delivered, defended in the oral examination room. | 14 | 20 | 100 | 0 |
The AI and Digital Practice Spine
AI, taught inside this trade
Applied Here The spine of Part Two, section 2.13 at diploma depth: 18 credit units across digital practice, since security is the discipline where digital judgement matters most.
AI tools for my trade
AI assisted detection and investigation verified against raw evidence; the suggestion tested before acting
Data in my trade
Log analysis, threat intelligence and SOC metrics as the analyst's daily data work
Working with automation
SIEM correlations, EDR containment and detection rules as security automation, supervised and improved by the analyst
Judgement, ethics and safety
The Computer Misuse Act line; the DPPA data boundary; the evidence chain that holds in court
Digital work and platform income
The security practice profile, retainer contracts and the remote security market, from SPN102
Learning outcomes
What the graduate can do
- PLO 1
Monitor, detect and investigate security events across network, endpoint and cloud environments
Level 5: operates complex technical systems with analytical responsibility
- PLO 2
Configure and manage network security, firewalls and endpoint protection at operator depth
Level 5: applies specialised skills within defined systems
- PLO 3
Run the incident response process from detection through recovery with documented evidence
Level 5: manages critical processes with accountability
- PLO 4
Conduct digital forensic investigations to evidentiary standard admissible in Ugandan proceedings
Level 5: applies specialised knowledge with legal accountability
- PLO 5
Execute authorised penetration tests and report findings in business language
Level 5: evaluates systems within legal and ethical limits
- PLO 6
Build and maintain security governance: policies, risk assessments and compliance evidence
Level 5: designs and manages within regulatory frameworks
- PLO 7
Apply the DPPA 2019 to security operations and handle evidence lawfully
Level 5: works within regulation with accountability
- PLO 8
Secure cloud environments and web applications at operator level
Level 5: applies knowledge across changing technology contexts
- PLO 9
Use AI assisted security tooling with verification and recognise AI enabled attacks
Level 5: applies new technology with adversarial awareness
- PLO 10
Operate the SOC: shift discipline, stack management, threat hunting and the improvement cycle
Level 5: manages operational systems with continuous improvement
- PLO 11
Communicate security findings to technical and non technical audiences, lead a team and operate as a compliant enterprise or high value employee
Level 5: manages own and others' work with professional communication
Entry routes
Four ways in
- Academic route. UACE with a principal pass, or UCE with a relevant National Certificate.
- Vocational route. FC-C10 or an equivalent National Certificate in computing, with credits recognised toward cognate modules; FC-C10 is the designed feeder.
- Recognition of prior learning. Practising IT professionals with security exposure assess against year one outcomes; advanced standing follows demonstrated competence.
- Mature age route. Applicants of twenty five and above with IT or security history enter through the access assessment.
Industrial training
Assessed weeks inside a working organisation
- Duration and placement
- Ten weeks in year one (ITRD601, 16 credit units, 150 hours minimum) and twelve weeks in year two (ITRD602, 20 credit units, 180 hours minimum).
- Host organisation types
- Banks and fintechs, telecoms, government IT security units, managed security service providers, IT audit and consulting firms, and the College's own security operations under arm's length supervision.
- Learning objectives
- Year one: monitoring, log analysis and basic incident response under supervision. Year two: SOC analyst, forensics and governance work at analyst level with a host project of measured security improvement.
- Supervision
- A named host supervisor security professional; the practice tutor visits at least twice per placement; data and evidence incidents escalate immediately under the Part Two policy.
- Logbook
- Daily entries against the objectives, countersigned weekly by the host supervisor, reviewed by the practice tutor at each visit, kept on the platform.
- Assessment
- Joint workplace assessment against the practice rubric each year, plus logbooks and the year two host project.
Assessment and certification
Continuous practical, plus UVTAB
A human assessor confirms every AI-avatar oral examination result before it stands, and the trainer who taught a learner never marks that learner's summative assessment.
- Internal continuous assessment, 60 per cent: workshop task assessments, module projects, logbooks and oral checkpoints, marked under the separation rule of Part Two.
- UVTAB external assessment, 40 per cent: the Board's written and practical occupational assessments for this qualification, taken at the gazetted sittings.
- Practical competency assessment: every practical outcome is assessed by observed performance against published criteria; evidence is retained.
- Oral examination option: any module checkpoint and the exit project defence may be taken in the AI avatar oral examination room, with human confirmation of every result.
- Grading scale: Distinction 80 to 100; Credit 65 to 79; Pass 50 to 64; Not Yet Competent below 50, with the right to reassessment.
- Pass and progression: every core module at Pass or above, all practical competencies demonstrated, industrial training completed, exit project at Pass or above.
- Resit rules: two reassessment opportunities per module without repeating attendance; a third attempt repeats the module; reassessment covers only the outcomes not yet demonstrated.
Exit project
A real venture, or a real employer brief
Venture route: launch a security services practice: the ENT201 plan, registration, at least one real security assessment or retainer delivered with documented findings closed, and a twelve month plan.
Employment route: deliver a complete organisation security project for a real or College sourced client: security assessment, monitoring deployment, governance pack, incident playbooks and measured improvement, to employer standard.
Deliverables:
The project file: scope, assessment findings, governance pack and improvement evidence The technical work: monitoring deployed, playbooks tested, findings remediated The evidence of value: security posture measured before and after, client The defence: presentation and oral examination, human confirmed Grading criterion Weight What excellent looks like Technical quality 30% Findings accurate; Value delivered 20% Posture measurably Use of AI tools 10% Detection and analysis Defence 10% Every decision explained
- The project file: scope, assessment findings, governance pack and improvement evidence
- The technical work: monitoring deployed, playbooks tested, findings remediated
- The evidence of value: security posture measured before and after, client
- The defence: presentation and oral examination, human confirmed Grading criterion Weight What excellent looks like Technical quality 30% Findings accurate; Value delivered 20% Posture measurably Use of AI tools 10% Detection and analysis Defence 10% Every decision explained
Progression
Where this qualification leads next
No Forward College learner ever meets a dead end.
Within Forward College: graduates enter FC-H06, the Higher Diploma in Cybersecurity and Digital Forensics, the designed next step, with the diploma's 240 credit units recognised toward cognate modules.
Into Forward University: the staircase runs through FC-H06 into the University's computing and information security degrees with credit transfer of up to one third under the Part Two, section 2.12 equivalence tables.