D481 Security Foundations is recorded under banner number ITAS 5100 and is worth 2 competency units. It is the graduate entry point: security terminology, principles and best practices, plus networking components, network security vulnerabilities and the administrative countermeasures that address them. D481 and ITAS 5100 are one requirement, and it is the graduate analogue of the undergraduate fundamentals courses. Its job is to make sure a cohort arriving from different backgrounds shares one vocabulary.
A levelling course with graduate expectations
Because a graduate cybersecurity cohort contains career changers, network engineers, developers and people already working in security, D481 exists to establish a shared baseline. That makes it feel easy to some students and dense to others, and both reactions produce the same mistake: treating it as a formality. It is short, but the expectations for how you write are already graduate expectations, and the marking standard for argument and sourcing does not soften because the content is foundational.
The principle material is the same triad of confidentiality, integrity and availability that runs through the field, but the graduate framing asks something more: not what each means, but what you trade when you favour one. Availability engineering multiplies copies of data and therefore multiplies confidentiality exposure. Strict integrity controls slow processes that people then work around. Being able to name a specific trade in a specific organization is the level being asked for.
The networking half is included because so much of security depends on understanding how traffic moves. Segmentation, the difference between filtering at the perimeter and at the workload, where encryption starts and stops, and what a flat network means for lateral movement are the ideas that matter. If networking is your weakest area, this is the cheapest possible moment to fix it, because every later course in the program assumes it.
Administrative countermeasures deserve emphasis because technical students undervalue them. Policy, standards, training, joiner and leaver processes and vendor management are controls, and in many real incidents they are the ones that failed. A graduate submission that treats administrative controls as seriously as technical ones is showing exactly the breadth the program wants.
Outcomes are logged as Competent or Not Competent, because letter grades and an ordinary grade point average do not exist here, while the 2 competency units simply size the course inside a flat-priced six month term. Two competency units inside a flat-priced six month term makes this an ideal course to close in the first weeks, freeing the term for the heavier courses that follow.
Turning a compact rubric into a graduate plan
If your version of D481 uses a performance assessment, the rubric is likely to be compact with high expectations per aspect. WGU requires a score of 2 in each aspect for a task to pass and scores each aspect alone, so on a short rubric one thin answer is a large proportion of your risk.
Budget precisely. Take a rubric with four scored aspects and a target near 1,400 words. Reserve 120 words for the organization and its information assets, and 90 for the close, leaving 1,190 across four aspects, or roughly 297 each. Weight by demand: an aspect asking you to analyse vulnerabilities and recommend countermeasures deserves 420, an aspect asking you to apply principles deserves 330, and two descriptive aspects take 220 each. That totals 1,190.
Write at graduate register from the first sentence. That means claims with support, terminology used exactly, and positions taken rather than summarised. The single clearest marker of graduate writing is that the reader can tell what the author thinks and why, and that habit established here carries through the entire program.
Reserve space to state a limitation of your own recommendation. Undergraduate work often reads as advocacy; graduate work is expected to acknowledge where an argument is weakest.
Shape for a foundations analysis at graduate level
D481 deliverables usually assess an organization's security position. These proportions fit a compact document.
| Section | Content | Share |
|---|---|---|
| Organization and assets | The business, its information assets, and what loss of each would cost in concrete terms. | 14 percent |
| Principles in tension | Where confidentiality, integrity and availability pull against each other here, with the trade named. | 17 percent |
| Network exposure | Topology, segmentation and the paths an intruder could take once inside. | 20 percent |
| Vulnerabilities | Specific weaknesses, technical and administrative, tied to assets and paths. | 19 percent |
| Countermeasures | Controls of both kinds, prioritised, with cost and residual exposure stated. | 21 percent |
| Close | The limitation of your own recommendation and what would change it. | 9 percent |
Graduate sourcing starts here
The sourcing standard in a graduate program is higher than in an undergraduate one, and establishing it in the first course saves effort later. Definitions come from standards bodies and national agency glossaries rather than from general reference sites. Control guidance comes from published frameworks. Empirical claims come from peer-reviewed research or from industry survey data with a stated method and year.
Graduate writing is also expected to engage rather than only to cite. Where two sources disagree, or where guidance has changed, saying so is a strength. A sentence noting that earlier guidance recommended one approach and current guidance prefers another, with both cited, demonstrates a level of engagement that a list of citations cannot.
Be precise about the boundary between the general and the applied. A framework's recommendation is general; your judgement about this organization is yours. Marking that boundary in plain language is both honest and, in graduate marking, rewarded, because evaluators are assessing your analysis rather than your ability to find guidance.
Keep currency in view. Security guidance is revised, and a citation to a superseded version of a framework is a small error that suggests the source was found rather than read. Give the version and the date.
Cite in whatever style your task sets out and cite at the point of claim. Where you present a risk or control table, include the basis for each rating, since unexplained ratings are the most common weakness carried from undergraduate into graduate work.
What Competent looks like at graduate entry
Competent submissions apply principles to a specific organization, treat administrative and technical controls with equal seriousness, prioritise rather than list, and end by naming a weakness in their own argument. The register is consistent and the sourcing is precise.
Returns follow four shapes. The document defines terms at length in a course whose aspects want application. Countermeasures are exclusively technical, ignoring the administrative half of the course description. Risk ratings have no stated basis. Or the writing is undergraduate in register, summarising sources without ever taking a position.
There is one more thing worth doing in the program's first course, and it pays across every course after it. Build a personal source shelf now: the standards body glossary you will use for definitions, the framework you will cite for controls, the national agency guidance you trust, and the citation style your program expects, all saved where you can reach them in ten seconds. Students who assemble that in week one stop losing an hour per assignment hunting for a definition they already used last month, and their terminology stays consistent across the whole degree, which evaluators notice.
A quick self-check for register: find every paragraph and ask whether it contains a claim you are making or only information you are reporting. A graduate document should be mostly the former, supported by the latter.
Performance assessment work can be revised and resubmitted with no grade penalty, so finish every aspect and submit rather than continuing to edit, rather than holding it back for another pass. If your section also carries an objective assessment, WGU objective assessments are proctored and our boundary is absolute: preparation only, with terminology drills, practice questions and a candid read on your preassessment result. We do not sit exams for anyone, are absent for the whole of it, and portal credentials are never requested or handled.
First graduate course, unfamiliar register?
Send the D481 rubric and scenario. We set the graduate voice, build the aspect plan with word targets, and mark where claims need support.
Eight mistakes that cost time in D481
- Treating a 2 CU course as a formality. The content is foundational; the writing standard is already graduate.
- Defining instead of applying. Aspects want principles read against this organization's assets.
- Technical controls only. Policy, training and joiner and leaver processes are countermeasures and are often the ones that failed.
- Reporting without arguing. Graduate writing takes positions. Say what you think and why.
- Unexplained ratings. Every likelihood and impact rating needs its basis stated.
- Superseded sources. Frameworks are revised. Cite the current version and date it.
- No stated limitation. Naming where your own recommendation is weakest is expected at this level.
- Skipping the networking material. Every later course in the program assumes it, and this is the cheapest place to fix a gap.
Three questions students ask about D481
I already work in security. Can I move through this quickly?
How does D481 relate to the undergraduate fundamentals courses?
What if my networking knowledge is weak?
Where D481 sits in WGU's programs
The July 2026 catalog places this code in 1 current WGU program. Open a program page for the complete standard path and term positions. The live Degree Plan remains authoritative after transfer credit, substitutions, and mentor planning.
The assessments, one by one
The public catalog does not publish this course's PA/OA identity or task count. WGU Tutors publishes at most one PA manual per course and only from a WGU-controlled public rubric. Until that source exists, PA help begins from the student's real Course of Study and OA support remains preparation only.