E016 is a three-unit graduate course in WGU's Master of Science, Information Technology programs, and it appears in both the standard and Product Management versions. WGU lists no prerequisites.
The guidebook says the course approaches an organization's risk needs from a management perspective. It explains how risk management protects sensitive data, intellectual property and digital assets from threats and breaches, and it covers governance structures, mitigation strategy and incident response planning.
Students often find the course demanding because three documents must agree. The governance design, the mitigation strategy and the response plan each address risk from a different angle, and a weak link between them is easy for a reader to spot.
Course at a Glance
| Item | Details |
|---|---|
| University | Western Governors University (WGU) |
| Course | E016, Risk Management and Information Technology |
| Competency units | 3 |
| Level | Graduate |
| Programs | MS Information Technology; MS Information Technology, Product Management |
| Prerequisites | None listed |
What E016 Covers
| Competency (WGU wording, summarized) | What it asks of you |
|---|---|
| Design a security incident response plan to maintain business continuity | Define roles, steps and communication for when something goes wrong |
| Design an organization's information security governance | Set structures, policies and accountability that support information assurance |
| Develop a risk mitigation strategy that complies with relevant regulations | Identify risks, choose responses and show that the plan meets legal and regulatory duties |
Key Concepts Explained
Risk as Likelihood and Impact
A risk is a possible event with a likelihood and a consequence. Ranking risks by both stops you from spending effort on a frequent nuisance while ignoring a rare event that could close the business.
Illustration: A clinic stores patient records in a cloud service. Risk A: a staff member sends an email to the wrong address (likely, low to moderate impact). Risk B: the cloud account is compromised (less likely, severe impact). A sound mitigation strategy treats both, but gives B stronger controls such as multi-factor authentication and monitoring, and gives A training and email warnings.
Governance
Governance answers who is accountable. It sets policies, assigns owners and defines how decisions and exceptions are approved. Good answers name roles rather than saying that the company will ensure security.
Incident Response and Continuity
A response plan covers preparation, detection, containment, recovery and review. Continuity asks a related question: how does the business keep operating meanwhile?
Typical Assignments and How to Approach Them
| Task element | What it tests | How to approach it |
|---|---|---|
| Governance design | Structure and accountability | Name roles, policies and review cycles that fit the organization |
| Risk mitigation strategy | Prioritized thinking and compliance | Rank risks, choose a response for each and cite the relevant regulation |
| Incident response plan | Operational readiness | Set phases, owners, escalation and communication steps |
| Rationale | Justification | Tie each decision to the scenario, not to generic best practice |
Keeping the Three Documents Consistent
Work from the top down. Start by listing the organization's key assets and the threats to them. Use that list to draft governance, so each asset has an owner and a policy. Then build the mitigation strategy from the same risks, and finally write the response plan for the events your strategy could not fully prevent.
| Document | Question it answers | Link back to |
|---|---|---|
| Governance | Who is responsible for what? | The asset list |
| Mitigation strategy | How do we reduce each risk? | The ranked risks |
| Response plan | What do we do if it happens anyway? | The residual risks |
Showing That a Plan Meets Regulation
The third competency asks for a mitigation strategy that complies with all relevant regulations. That phrase is easy to under-answer.
Begin by identifying what kind of data the organization holds and where it operates, because those facts decide which rules apply. Health data, payment card data and personal data about residents of particular regions each bring different obligations.
Then connect each rule to a control in your strategy. A short table is an efficient way to show this, and it makes it easy for a reader to check that nothing is missing.
| Data or activity | Obligation to identify | Control in your strategy |
|---|---|---|
| Patient or customer records | The relevant privacy or health-data rule | Access limits, logging, retention policy |
| Payment details | The relevant payment industry standard | Encryption, segmentation, annual review |
| Breach events | Notification duties and timing | Escalation steps in the response plan |
Check the exact rules named in your task materials and use those, since the scenario decides which ones are relevant.
Where Students Get Stuck
- Generic controls. Listing every well-known control without tying it to a risk in the scenario reads as padding.
- Ignoring regulation. The mitigation competency expects you to identify relevant rules, such as those for the data the organization holds.
- Technical depth where management is expected. The course takes a management perspective, so focus on decisions, owners and priorities.
- Response plans without owners. Every step needs a named role.
Study Tips for E016
- Make a one-page risk register for the scenario before writing: asset, threat, likelihood, impact, response.
- Use headings that mirror the three competencies.
- Check that every high-ranked risk appears in both the strategy and the response plan.
- Read the course planning tool report with your instructor and give extra time to your weakest area.
How We Help with E016
Send the case, the task instructions and the rubric. A writer can prepare a model risk plan, explain the governance and response structure, or review your draft for consistency. The work is study support: learn from it and submit your own work under WGU's academic integrity policy.
GradeEssays is independent of Western Governors University. Orders are written from scratch, include free revisions within the scope of your original request, and are refunded in full if late. For policy-style writing, see our policy brief guide.
Get Your E016 Risk Plan in Order
Share the case, your draft and any feedback. We explain how to link each risk to a control and a response.
Start My E016 HelpFree revisions · Full refund if late · Written from scratch for your order
Frequently Asked Questions
WGU lists none.
The guidebook lists 3.
It takes a management perspective: governance, mitigation strategy and response planning rather than hands-on configuration.
Designing an incident response plan, designing information security governance, and developing a compliant risk mitigation strategy.
Both the MS Information Technology and the Product Management version.
Yes. We check ranking, links between sections and the match to your rubric, and explain what to change.