Level 3 Diploma in Cyber Security Management and Operations
Cyber security treated as a management problem as much as a technical one. Six units from threat and risk through incident response to data protection law, at 60 credits, for people who want the Level 4 cyber route or a better understanding of the risks in their own workplace.
Its 60 credits add nothing to a points total and will not satisfy a university offer expressed in points. What it does lead to is a Level 4 diploma delivered by London School of Planning and Management (LSPM), or first-year university entry where a university chooses to allow it. If you need Tariff points, this diploma is the wrong programme for you.
At a glance
- Level3 (RQF)
- Credits60
- Total qualification timeSee specification
- Guided learning hoursSee specification
- Awarding bodyQualifi
- Ofqual number603/3334/0
- Units6 mandatory, 0 optional
- UCAS TariffNone
- Duration9 months (standard) or 6 months (fast track)
- Study modesOnline, Blended, Evening classes
- FeesFrom £999 (9 months, standard) or £1,299 (6 months, fast track)
- Next intakeRolling intake — course starts when the fee is paid
Level, credits, hours, Ofqual number and unit list are taken from the Qualifi qualification specification (PDF) and the Ofqual register. Duration, study modes, fees and intake dates are set by LSPM, not by this site, and are confirmed by its admissions team.
Photograph slot, to be supplied by LSPM and taken at its own premises (this site has no campus): an incident-response tabletop exercise: three learners round a printed timeline and a laptop showing a log file, one taking notes on a flipchart.
In brief
Most people expect a cyber security course to be about hacking. This one is about what an organisation should do before, during and after something goes wrong. Threat and Risk: Expecting the Unexpected sets the frame; Network Architecture: Communications and Protocols and Mobile Device and Data Risks cover where the exposure is; Investigations and Incident Response is the during-and-after unit; Solutions: Future-Proofing your Business and EU GDPR and Data Security deal with prevention and the legal duties that sit behind it.
Qualifi's entry wording is explicitly friendly to people coming from work: Level 2 qualifications, or business experience with clear career goals, or a Level 3 in another discipline. That shapes the cohort. Expect classmates who are administrators, junior IT staff or small-business owners as well as school leavers.
Per-unit credit values and total qualification time are not quoted in a form we can reproduce from the specification, so those fields read see specification. The 60-credit total and Ofqual number are confirmed.
Written by Education adviser, CogniPath Education. Not by LSPM. Facts checked against the awarding body specification and the Ofqual register, September 2026.
Who it suits, and who it does not
A good fit if you are
- Junior IT or administrative staff who have been handed responsibility for security and want to understand it properly.
- Small-business owners who are the de facto data controller and know it.
- School or college leavers who want the cyber route at Level 4 and prefer a security-first introduction to a general IT one.
- Career changers with a Level 3 in another subject.
Look elsewhere if you are
- Anyone hoping for a penetration-testing or ethical-hacking course; the emphasis here is management and operations.
- People who need UCAS Tariff points for a university offer.
- Learners with no experience of computers at all, who would be better starting with the OTHM Foundation Diploma in Information Technology.
- Those seeking a vendor security certification.
What you study
six mandatory units. There are no optional units, so every learner on the programme covers the same ground.
| # | Unit | Type | Credits |
|---|---|---|---|
| 1 | Threat and Risk: Expecting the Unexpected | Mandatory | See spec. |
| 2 | Network Architecture: Communications and Protocols | Mandatory | See spec. |
| 3 | Mobile Device and Data Risks | Mandatory | See spec. |
| 4 | Investigations and Incident Response | Mandatory | See spec. |
| 5 | Solutions: Future-Proofing your Business | Mandatory | See spec. |
| 6 | EU GDPR and Data Security | Mandatory | See spec. |
| Total | 6 units | 60 |
Unit titles and credit values from the Qualifi qualification specification (PDF). Where the specification does not state a credit value for a unit, the cell reads See spec.
The units run in the order Qualifi lists them, because each assumes the last: you cannot write an incident response plan until you understand the network it protects, and the GDPR unit lands best once you have seen what a breach actually involves.
Entry requirements
Qualifi sets the formal entry criteria for this qualification and LSPM, as the approved centre, applies them when it admits learners. As published by the awarding body:
- Qualifications at Level 2 and/or;
- Work experience in a business environment and demonstrate ambition with clear career goals;
- A Level 3 qualification in another discipline and who want to develop their careers in business management and/or risk management.
LSPM interprets Qualifi's three entry routes generously. A Level 2 qualification, a job that has involved handling data or systems, or a Level 3 in anything else will do. What it checks is that you can write a structured report, because five of the six assessments are exactly that.
Source: the Qualifi qualification specification (PDF), which is the definitive statement of the awarding body's criteria. LSPM's admissions team decides eligibility; ask us first if you are unsure whether you meet them.
How you are assessed
One assignment per unit, most of them reports built around a case organisation. Investigations and Incident Response uses a scenario exercise with a written debrief. Marked by LSPM's tutors, quality assured by Qualifi.
Assessment is regulated by Qualifi under Ofqual's conditions. How awarding bodies and regulation work.
Where it leads: progression to Level 4
This diploma feeds a Level 4 diploma in cyber security or IT at LSPM, where the same six themes reappear with more technical depth. Learners who realise they prefer the law and compliance side sometimes progress to a Level 4 business or law route instead.
It carries no UCAS Tariff points and does not by itself meet a points-based offer for a cyber security degree. First-year entry to a degree on the strength of it is possible only where an individual university chooses to allow it. Employers value the GDPR and incident response units on their own terms, but this is not a professional certification.
If you want to compare Level 4 subjects in it, data and cyber security before committing to this diploma, our sibling site level4diploma.org is written for exactly that question.
Questions about this programme
Is this a technical or a management qualification?
Both, with the balance tipped towards management. You will learn how networks and mobile devices create risk and how incidents are investigated, but the assessments ask you to plan, assess and respond as someone responsible for an organisation, not to configure a firewall.
Does the GDPR unit still apply after the UK left the EU?
Yes. The unit title refers to the EU regulation, and the UK GDPR that applies in Britain is derived from it with the same core principles. LSPM teaches the UK position and notes where it differs.
Does this count for UCAS points?
No. It is on the Ofqual register but UCAS has not allocated Tariff points to it. Progression is to Level 4 at LSPM.
What does the incident response scenario involve?
You are given a simulated breach at a small organisation, with logs, emails and a timeline, and asked to run the response: contain, investigate, notify, record. You then write it up as a debrief. Nobody is expected to do live forensics.
Can I do this alongside a full-time job?
Many learners do. Study modes and duration are set by LSPM and confirmed on enquiry. The report-based assessment suits people who can read and write in the evenings.
Also in IT, Data and Cyber Security
Not sure which route fits? Ask someone who will tell you straight.
We are an independent agent, not LSPM's sales team, and we will say whether a UCAS application, an Access course or a Level 3 diploma is the better option for you, even when the answer earns this site nothing. Replies within two working days.