Skip to main content
FORWARD
University
Forward College · The Future is Here · FC-H06

Higher Diploma in Cybersecurity and Digital Forensics

Uganda's digitisation has outrun its security capability at every level, and the shortage is most acute above the analyst: the country has very few people who can architect a secure system, lead a major incident, produce forensic evidence that survives cross examination, or design a security programme a board will fund.

Higher Diploma
UVQF Level 6, higher diploma, technologist
2 years
Duration
240 CU
2400 notional hours
71%
Practical and industrial hours
90 days
Stated pathway to income

Occupational profile

What you'll be paid to do

Uganda's digitisation has outrun its security capability at every level, and the shortage is most acute above the analyst: the country has very few people who can architect a secure system, lead a major incident, produce forensic evidence that survives cross examination, or design a security programme a board will fund.

These are the roles banks, telecoms, regulators and law enforcement compete for and currently import.

The graduate works as any of the following, at the top of the region's technical salary range: architect technology companies, monthly; remote rates remote clients higher own practice engagement fees threat lead providers, large enterprises monthly practice founder regional clients assurance and testing

Occupations, employers and observed starting earnings
OccupationWhere the work isStarting earnings, observed 2026
Security engineer and architectBanks, telecoms, technology companies, remote clientsUGX 2,500,000 to 6,000,000 monthly; remote rates higher
Digital forensics examiner and expert witnessLaw enforcement units, legal and forensic firms, own practiceUGX 2,200,000 to 5,000,000 monthly; expert engagement fees
Incident response and threat leadBanks, managed security providers, large enterprisesUGX 2,500,000 to 5,500,000 monthly
Security consultant and practice founderOwn consultancy serving regional clientsEngagement rates; the assurance and testing

The 90-Day Promise

From certification to income, stated concretely

Day Pathway Named employer categories with which the College holds or is concluding placement and hiring partnerships: banks and fintechs; telecoms; managed financial and communications regulators; audit and consulting firms; legal firms requiring forensic expertise; and regional security firms offering remote engagement.

Partnership target: twenty active partners by the first cohort's year two training, each offering at least two placements.

The ninety day pathway from certification to income:

Day 0: graduation with the Capability Transcript, the mentor's reference, a capstone with measured security effect, the moot court testimony assessment, and the external panel's evaluation.

  1. Day 0: graduation with the Capability Transcript, the mentor's reference, a capstone with measured security effect, the moot court testimony assessment, and the external panel's evaluation.

  2. Days 1 to 30: employed route: three arranged interviews in a market where senior security vacancies remain open for months. Remote and consulting route: profiles and assurance service listings live; the mentor reviews rate setting.

  3. Days 31 to 90: employed route: probation support from the practice tutor. Practice route: referral listing for partner overflow assessment, testing and forensic engagements, standing terms in the partnerships.

  4. Measurement: employment, consulting or trading status recorded at day 90 and published in the annual outcomes report, per Part Two, section 2.9. PART SIX INSTITUTIONAL DELIVERY How the twenty eight programmes of Parts Three, Four and Five are actually brought into being: the phased rollout, the staffing establishment, the facilities and capital plan, the operating economics, the partnerships on which work based learning depends, and the quality assurance and evaluation systems that will hold the College to the promises this compendium makes. 6.1 Phased Rollout and Launch Sequence The College does not open with twenty eight programmes. It opens with seven and grows to the full portfolio over four years, and the sequence is determined by three things: which occupations the labour market is most urgently short of, which programmes share facilities so that early capital is used twice, and which awards depend on feeder programmes that must exist first. The third consideration governs the Higher Diplomas. FC-H01, FC-H02, FC-H03 and FC-H06 are entered from Diplomas that the College must first be graduating, which places them in Phase Four. FC-H04 and FC-H05 are exceptions and arrive in Phase Three, because both are one year conversions designed for people already employed in construction and health technology who hold existing diplomas from other institutions, so their intake does not depend on the College's own pipeline. Phase Timing New Programmes New intake programmes launched Phase One Year one of 7 FC-C01, FC- 210 learners operation C05, FC-C08, Phase Two Year two of 7 FC-C02, FC- 210 learners operation C06, FC-C07, Phase Three Year three of 7 FC-C03, FC- 210 learners operation C04, FC-D02, Phase Four Year four of 7 FC-D04, FC- 210 learners operation D05, FC-D08, Cumulative enrolment builds as cohorts overlap. The table below models steady state on the planning assumption of one cohort of thirty per programme per year, with two year awards carrying two cohorts concurrently. Phase Programmes New intake Total learners on running roll Phase One 7 210 270 Phase Two 14 210 630 Phase Three 21 210 990 Phase Four 28 210 1410 At full portfolio the College carries approximately one thousand four hundred and ten learners on roll. This is the planning figure against which staffing, facilities and operating costs in the sections that follow are calculated. Growth beyond that figure is achieved by adding parallel cohorts to programmes with proven demand rather than by adding programmes, since twenty eight is judged the practical ceiling for quality management at a single campus. THE ROLLOUT RULE No programme launches until its workshop is commissioned, its lead trainer is recruited and inducted, and at least eight industrial training partners have signed placement agreements for its first cohort. A programme that cannot meet all three conditions is deferred to the next phase rather than launched thin. This rule is binding and its application is reported to the Academic Board. 6.2 Staffing Establishment Every programme in Parts Three, Four and Five specifies its own trainer requirement in section 13 of its template entry. This section aggregates those requirements into an establishment and a recruitment sequence. The staffing model follows the ratios stated in each programme: one to twelve or one to sixteen in workshop and laboratory work depending on hazard, and one to thirty in theory. A cohort of thirty in a workshop based programme therefore requires a lead trainer plus two or three instructors, and those instructors are shared across programmes wherever facilities and disciplines overlap. 6.2.1 Academic establishment at full portfolio Role Posts Notes Principal 1 Overall leadership and Academic quality assurance and Enterprise training, graduate Lead trainer 28 One per programme, instructor programmes; the hazard tutor supervision, visits and Programme mentor 14 Learner progression, the Assessment and 4 Internal verification, inclusion officer wellbeing referral Academic establishment at full portfolio: one hundred and thirty four posts against approximately one thousand four hundred and ten learners, a ratio of about one academic staff member to eleven learners. That ratio is higher than a conventional lecture based institution requires and is a deliberate consequence of the compendium's hands on share, which sits between sixty nine and seventy six per cent across every programme. Workshop teaching is staff intensive; the compendium does not pretend otherwise. 6.2.2 Professional and support establishment Function Posts Notes technical support maintenance, stores catering operations where these Human resources 3 outreach outreach and the 6.2.3 Recruitment sequence and the trainer development pathway Lead trainers are recruited nine months before their programme launches and spend the final three months in curriculum induction, the College AI induction, workshop commissioning and partner negotiation. This lead time is not a luxury: a lead trainer who arrives with the first cohort has neither commissioned their workshop nor built their placement network, and the programme's first year is compromised. The College faces a real constraint in recruiting trainers who combine three ways. First, industrial practice is treated as the non negotiable requirement and instructor certification as the developable one, with the College funding pedagogical qualification for practitioners it recruits. Second, partner industries second practitioners to teach specialist modules under a lead trainer's moderation, which is written into the partnership agreements described in section 6.5. Third, the College's own Higher Diploma graduates are a designed source of future instructors, and the pathway from toward. CONTINUING INDUSTRIAL CURRENCY Every trainer is required to complete a minimum of ten days of industrial placement or documented industry engagement each year, and this is a condition of continued teaching assignment rather than a development aspiration. A trade trainer whose practice is five years stale is teaching the trade as it was, and in the occupations this compendium covers that is a serious harm to learners. 6.3 Facilities, Equipment and the Capital Plan Section 14 of each programme entry specifies its equipment schedule. Across the portfolio those schedules contain three hundred and thirteen distinct equipment lines. This section aggregates them into shared facilities, states what is genuinely shared, and sequences the capital spend against the rollout. 6.3.1 Facility clusters and sharing The portfolio is deliberately constructed so that expensive facilities serve several programmes. The sharing is not a cost saving applied after the fact; it is a design principle stated in the programme entries themselves, and it is one reason the compendium's programme mix looks as it does. Facility cluster Serves Principal shared assets Engineering and FC-C03, FC-C04, FC-D02, The integrated training automation hall FC-D03, FC-H02, FC-H03, plant, PLC and drives FC-H06 benches, robotics cell, yard materials testing microgrid benches, the training FC-H06 and staging environments, facility grain, dairy, fruit and laboratory calibration and safety operation kitchen, front office and workshop and finishing centre space supporting every 6.3.2 Capital sequencing Capital is committed phase by phase and never ahead of enrolment. Each phase commissions only the facilities its launching programmes require, plus the shared elements that later phases will extend. The pattern is that early phases carry the digital and hospitality clusters, which have lower capital intensity and faster enrolment, and the heavy engineering and processing clusters follow once the College's revenue base and partner network can support them. Phase Facilities commissioned Capital intensity Phase One Digital and AI laboratories Moderate; workstation Phase Two Agriculture and Moderate to high; Phase Three Energy laboratory and High; the microgrid and Phase Four Engineering and Highest; deferred 6.3.3 Consumables, maintenance and refresh Workshop based training consumes materials continuously, and the most common failure of technical institutions in the region is a well equipped workshop with no consumables budget, where equipment stands idle because there is no timber, no filament, no reagent and no fuel. The College treats consumables as a recurrent cost with a protected budget line calculated per learner per programme, not as a discretionary item to be cut when revenue is tight.

Programme structure

Every module, with its arithmetic

One credit unit equals ten notional learning hours. 240 credit units, 2400 notional hours: 680 contact, 1385 practical and 330 industrial hours, so practical and industrial hours are 71 per cent of the programme.

h g d g and s at al and on One and y and ial Two Practical and industrial hours together are 1715 of 2400 notional hours, 71 per cent, meeting the hands on test.

Semester 1

Modules in semester 1
CodeModuleCUContact hPractical hIndustry h
CDF301Security Architecture and EngineeringAbove the analyst who watches sits the engineer who designs what is watched: the learner architects secure systems rather than bolting controls onto insecure ones.1450900
CDF302Advanced Digital ForensicsYear one's forensic depth: the learner conducts investigations across storage, memory, mobile and cloud to a standard that survives cross examination in Ugandan proceedings.1445950
CDF303Threat Intelligence and Advanced Detection EngineeringDetection stops being a product setting and becomes engineering: the learner builds detection capability driven by threat intelligence and hunts adversaries who evade default rules.1445950
RES301Applied Research and Evidence PracticeThe Level 6 difference is evidence: the technologist who can frame a question, gather data honestly and defend a conclusion is the one trusted with decisions. This module builds that discipline in applied, workplace terms.1045550

Semester 2

Modules in semester 2
CodeModuleCUContact hPractical hIndustry h
CDF304Incident Command and Crisis Management1450900
CDF305Offensive Security and Red Team OperationsWhen a major incident runs, someone must command it: the learner leads incident response across technical, legal, communications and executive dimensions under real time pressure.14401000
CDF306Security Governance, Risk and Audit at Enterprise LevelThe Level 6 governance difference is designing the programme rather than following it: the learner builds enterprise1455850
SPNH601AI spineAI Security,The Higher Diploma spine: AI is now both the most powerful tool in the defender's hands and a new attack surface with its own vulnerabilities, and the graduate must be fluent in both directions.16551050
ITRH601Industrial Training OneTen assessed weeks in a security operation at the end of year one, at Level 6 responsibility, under the Part Two policy.16010150

Semester 3

Modules in semester 3
CodeModuleCUContact hPractical hIndustry h
CDF401Investigations, Evidence and Expert TestimonyYear two's core: the learner runs complete investigations and stands behind them in the witness box, which is the professional act that distinguishes a forensic examiner from a technician with tools.18601200
CDF402Critical Infrastructure and Specialise d Systems SecurityThe systems whose failure is measured in lives rather than money: the learner secures the operational technology, financial and telecommunications infrastructure Uganda depends on.16501100
CDF403Advanced Practice ElectiveDepth beats breadth at Level 6: the learner specialises in one strand to genuine professional depth, building the portfolio that makes them hireable for a specific senior role.16501100
LEAD301Technical Leadership and Project ManagementThe Higher Diploma exists to produce the person who runs the team and the project: this module builds the leadership, planning and financial control that separates a technologist from a technician.1250700

Semester 4

Modules in semester 4
CodeModuleCUContact hPractical hIndustry h
SPN102AI spineDigital Work and Platform IncomeThe shortest module with the fastest payback: how a technician finds customers, prices work, invoices and gets paid through digital channels.415200
ENT301Technology Enterprise and Commercial PracticeAt Level 6 the enterprise question changes from can you trade to can you build something that scales: this module treats the technology business, its finance, contracts and growth, at the depth the graduate's ventures now require.1040600
ITRH602Industrial Training TwoTwelve assessed weeks in year two at technologist level with a substantial host project, under the Part Two policy.20020180
EXPH601Capstone Security ProjectThe Level 6 closing argument: a complete security engineering, forensic or programme project delivered with measured effect, defended before a professional panel including external18301500

The AI and Digital Practice Spine

AI, taught inside this trade

Applied Here The spine of Part Two, section 2.13 at Higher Diploma depth: 20 credit units across SPNH601 and SPN102.

  • AI tools for my trade

    AI assisted detection, triage and automation engineered with measured effect and the decision authority retained by the analyst

  • Data in my trade

    Telemetry, threat intelligence and forensic artefacts analysed into findings with stated confidence levels

  • Working with automation

    Detection pipelines and response automation built by the engineer and bounded deliberately

  • Judgement, ethics and safety

    The authorisation boundary of the Computer Misuse Act; proportionality in investigation; the honest concession under cross examination

  • Digital work and platform income

    The consultancy profile, assurance engagements and expert witness work, from SPN102 and ENT301

Learning outcomes

What the graduate can do

  1. PLO 1

    Design secure architectures and engineer secure infrastructure with correct cryptographic practice

    Level 6: designs complex systems with critical judgement

  2. PLO 2

    Conduct advanced digital forensic acquisition and analysis across storage, memory, mobile and cloud

    Level 6: applies advanced expertise with evidentiary accountability

  3. PLO 3

    Produce threat intelligence and engineer detections with measured coverage

    Level 6: analyses complex information into operational capability

  4. PLO 4

    Command major incidents across technical, legal and communication dimensions

    Level 6: leads under pressure with accountability

  5. PLO 5

    Conduct advanced authorised offensive testing and red team operations within legal limits

    Level 6: exercises expertise within strict ethical and legal boundaries

  6. PLO 6

    Design enterprise security programmes and quantify risk for executive decision

    Level 6: designs and manages within governance frameworks

  7. PLO 7

    Manage investigations lawfully and give expert testimony that withstands cross examination

    Level 6: exercises professional judgement with legal accountability

  8. PLO 8

    Secure critical infrastructure across operational technology, financial and telecommunications sectors

    Level 6: applies expertise where failure has severe consequence

  9. PLO 9

    Engineer AI assisted defence and attack and defend machine learning systems

    Level 6: applies new technology with critical evaluation

  10. PLO 10

    Conduct applied research and defend evidence based conclusions

    Level 6: investigates and reports with rigour

  11. PLO 11

    Lead technical teams and manage security projects to scope and budget

    Level 6: manages resources and people with accountability

  12. PLO 12

    Build and operate a security practice with defensible commercial and professional standards

    Level 6: operates autonomously with commercial responsibility

Entry routes

Four ways in

  • Academic route. A Diploma at UVQF Level 5 in cybersecurity, computing, networking or a cognate field, or an equivalent qualification.
  • Vocational route. FC-D06 Cybersecurity Operations is the designed feeder, with its 240 credit units recognised toward cognate modules; FC-D01 and FC-D11 graduates enter with bridging in CDF301.
  • Recognition of prior learning. Practising security professionals assess against year one outcomes; advanced standing follows demonstrated competence and a technical assessment, with the law and ethics components never exempted.
  • Mature age route. Applicants of twenty five and above with substantial security or investigative practice enter through the access assessment and technical interview.
Already skilled? The RPL route

Industrial training

Assessed weeks inside a working organisation

Duration and placement
Ten weeks in year one (ITRH601, 16 credit units, 150 hours minimum) and twelve weeks in year two (ITRH602, 20 credit units, 180 hours minimum).
Host organisation types
Banks and fintechs, telecoms, managed security service providers, law enforcement digital investigation units, regulators, audit and consulting firms, and remote placements with regional security firms.
Learning objectives
Year one: security engineering, detection and forensic work at technologist level under supervision. Year two: incident leadership, investigation and governance work with a substantial host project.
Supervision
A named host supervisor senior security professional; the practice tutor visits at least twice per placement or reviews remotely; evidence handling and authorisation incidents escalate immediately.
Logbook
Daily entries against the objectives, countersigned weekly by the host supervisor, reviewed by the practice tutor at each visit, kept on the platform.
Assessment
Joint workplace assessment against the Level 6 practice rubric each year, plus logbooks and the year two host project.

Assessment and certification

Continuous practical, plus UVTAB

A human assessor confirms every AI-avatar oral examination result before it stands, and the trainer who taught a learner never marks that learner's summative assessment.

  • Internal continuous assessment, 60 per cent: workshop task assessments, module projects, logbooks and oral checkpoints, marked under the separation rule of Part Two.
  • UVTAB external assessment, 40 per cent: the Board's written and practical occupational assessments for this qualification, taken at the gazetted sittings.
  • Practical competency assessment: every practical outcome is assessed by observed performance against published criteria; evidence is retained.
  • Oral examination option: any module checkpoint and the exit project defence may be taken in the AI avatar oral examination room, with
  • Grading scale: Distinction 80 to 100; Credit 65 to 79; Pass 50 to 64; Not Yet Competent below 50, with the right to reassessment.
  • Pass and progression: every core module at Pass or above, all practical competencies demonstrated, industrial training completed, exit project at Pass or above.
  • Resit rules: two reassessment opportunities per module without repeating attendance; a third attempt repeats the module; reassessment covers only the outcomes not yet demonstrated.

Exit project

A real venture, or a real employer brief

The capstone is a complete security engineering, forensic or programme implemented with assessed improvement, a complete forensic investigation with a court ready report defended under cross examination, a detection and response capability engineered with measured coverage gain, or an candidates may instead establish a security practice with at least three delivered client engagements to the same standard.

Deliverables:

The technical file: design, methodology, evidence and the reasoning The delivered work: the implemented system, investigation or programme The legal and ethical file: authorisation, proportionality, DPPA compliance and evidence handling The defence: presentation, technical examination and oral defence Grading criterion Weight What excellent looks like Technical quality 30% The work is rigorous and scrutiny Measured effect 20% Security improvement or Professional 15% Reports and briefings communication usable by technical and Defence 15% Findings withstand

  • The technical file: design, methodology, evidence and the reasoning
  • The delivered work: the implemented system, investigation or programme
  • The legal and ethical file: authorisation, proportionality, DPPA compliance and evidence handling
  • The defence: presentation, technical examination and oral defence Grading criterion Weight What excellent looks like Technical quality 30% The work is rigorous and scrutiny Measured effect 20% Security improvement or Professional 15% Reports and briefings communication usable by technical and Defence 15% Findings withstand

Progression

Where this qualification leads next

No Forward College learner ever meets a dead end.

Into Forward University:

FC-H06 graduates enter the University's computing, information security and forensic science degrees with credit transfer of up to one half at Level 6 under the Part Two, section 2.12 equivalence tables.

Professionally: the award is designed for direct employer recognition at security engineer, forensic examiner and security lead level, and the capstone panel includes external industry and legal assessors for that reason.