The Extended Certificate is made up of five units. Two units are assessed externally through exams, with the remaining three assessed internally through practical coursework and investigative projects.
Externally Assessed Units (Exams)
These units provide the core technical understanding behind cyber security.
Fundamentals of Cyber Security
You will explore different types of cyber threats, system vulnerabilities, attack methods and the principles behind securing modern networks and devices. You’ll also examine legislation, ethical considerations and the impact of cyber-attacks on individuals and organisations.
Cyber Security Incident Management
This unit focuses on how organisations prepare for, respond to and recover from cyber incidents. Students learn about incident detection, containment strategies, communication protocols and post-incident review processes used by professional security teams.
Internally Assessed Units (Coursework / Practical Projects)
These units develop applied skills used in real cyber-security work. Some possible areas of study include:
Security Testing and Vulnerability Assessment
Students carry out practical investigations to identify weaknesses in systems and networks. This includes analysing risks, selecting appropriate tools and recommending improvements to strengthen security.
Digital Forensics and Evidence Handling
This unit explores how digital evidence is collected, preserved and examined following an incident. Students learn basic forensic techniques and consider what different types of data can reveal about cyber activity.
Secure System Design
Students design and justify a secure system or solution for a given scenario. This includes proposing appropriate controls, addressing user needs, and evaluating how effectively the solution mitigates identified threats.
What are lessons like in this subject?
Cambridge OCR AAQ in IT: Cyber Security
The AAQ in Cyber Security is designed for learners who want to understand how modern organisations protect their systems, data and people from digital threats. Students explore how cyber-attacks happen, why systems are vulnerable, and what businesses do to prevent, detect and respond to incidents.
Lessons combine teacher-led theory, hands-on practical investigation, simulated security scenarios and guided research tasks. Students work with real examples of cyber breaches, analyse vulnerabilities, and practise applying industry-relevant processes such as risk assessment, secure system configuration and incident response planning.
The course also introduces learners to wider themes such as social engineering, digital forensics, secure networking and the legal responsibilities surrounding data and digital behaviour. Links to universities and employers in the digital sector help students prepare for further study in cyber security, computer science, digital forensics or wider IT roles.
What will I study?
What our
students
NEW COURSE FOR 2026
