D489 Cybersecurity Management carries banner number ITAS 6320 and is worth 4 competency units. It covers developing organizational information security programs and policies that follow recognised standards and governing laws, together with institutional risk management and compliance. D489 and ITAS 6320 are one requirement. The audience for everything you write here is an executive who controls budget and has other priorities.
Managing security means competing for resources
At this level security stops being a technical discipline and becomes an argument for allocation. Every control you want costs money, headcount or friction, and it competes against product development, hiring and everything else the organization wants to do. The management skill is translating risk into terms an executive weighs naturally: expected loss, regulatory exposure, contractual obligation, continuity of revenue and reputation. A submission that argues from threat sophistication rather than from consequence is arguing in the wrong currency.
Policy is the instrument the function actually controls. Policy sets what must happen, standards say to what specification, procedures say how, and guidelines suggest. Students routinely write a policy that is really a procedure, which makes it unmaintainable because every technical change requires a policy revision. Keeping policy at the level of durable requirements, with the volatile detail pushed into standards below it, is a practical skill this course rewards.
Institutional risk management is the third strand. Risk registers, risk appetite, escalation thresholds and a named owner for every accepted risk are the machinery, and the important idea is that an organization decides how much risk it will carry rather than discovering it. When a scenario mentions a board or an audit committee, it is asking about where risk decisions surface.
The workforce dimension deserves attention because it is where programs most often fail. Hiring, retention, capability development and the reality that security staff are scarce all shape what a program can plausibly do. A plan that assumes you can recruit three analysts in a quarter is a plan with a hidden assumption.
Work here returns Competent or Not Competent, because letter grades and an ordinary grade point average do not exist here, with 4 competency units describing its share of a flat-priced six month term.
Turning aspects into an executive document
If your version of D489 uses a performance assessment, the aspects usually span program, policy, risk and compliance. WGU requires a score of 2 in each aspect for a task to pass and judges each aspect alone, so an excellent policy will not carry an unaddressed risk governance or workforce aspect.
Budget before drafting. Take a rubric with seven scored aspects and a target near 2,600 words. Reserve 170 words for the organization and its business objectives, and 130 for the close, leaving 2,300 across seven aspects, or roughly 328 each. Weight by demand: three aspects requiring analysis and recommendation take 430 each, which is 1,290; the four remaining aspects, covering policy content, roles, compliance and measurement, take 252 each, which is 1,008. Together that is 2,298.
Write every recommendation with four elements: what you propose, what it costs, what risk it reduces, and what happens if it is declined. That last element is the one that turns a wish list into a decision document, and it is what an executive reader is actually looking for.
Reserve budget for the phased option. Real security proposals are rarely accepted whole, so presenting a minimum viable version alongside the full one, with the difference in residual risk stated, demonstrates that you understand how these decisions are made.
Shape for a security management proposal
D489 deliverables usually propose or assess a security program at organizational level. These proportions fit that document.
| Section | Content | Share |
|---|---|---|
| Business and obligations | What the organization does, what it must protect, and the legal and contractual duties in force. | 13 percent |
| Program structure | Mandate, reporting line, functions, staffing and where authority sits. | 16 percent |
| Risk governance | Register, appetite, escalation thresholds, acceptance owners and how risk reaches the board. | 18 percent |
| Policy framework | The policy set proposed, the hierarchy beneath it, owners and review cycle. | 17 percent |
| Compliance approach | Which obligations apply, how conformance is evidenced, and who is audited by whom. | 14 percent |
| Measurement and reporting | Program measures, the executive report and what each measure would trigger. | 14 percent |
| Close | Phased option, its residual risk, and the consequence of declining entirely. | 8 percent |
Evidence an executive reader would accept
Program structure and control expectations belong to published frameworks and standards, cited by revision. Legal obligations belong to the regulation or its official guidance. Both should be kept clearly separate, because an executive needs to know which requirements are enforceable by an outside party.
Claims about likelihood and cost of incidents are empirical and belong to published research or industry data with a year and a method. Executives read these figures sceptically and rightly so, since sector, size and geography change them substantially. Citing a figure with its population, and noting where the scenario organization differs, is far more persuasive than a headline number.
Where you estimate cost or effort, show the arithmetic and label it an estimate. Two analysts at a stated salary band plus tooling at a stated tier is a defensible figure; a total with no components is not. Executives evaluate proposals by interrogating the components, and a proposal that cannot be interrogated tends to be declined.
Use the scenario's own constraints throughout. Headcount, budget signals, existing tooling and the presence or absence of an audit function all shape what the program can be, and referencing them is what stops the document from reading as a generic template.
Keep to the citation style the task requires and place each reference beside the claim it supports. A risk register extract, with risk, likelihood, impact, current control, residual rating and acceptance owner, is the single most useful table in this document.
Competent management writing and returned work
Competent submissions argue in business terms, size the program to the organization, name owners for accepted risk, keep the policy hierarchy clean, and offer a phased option with its residual risk stated.
Returns follow four shapes. The document argues from threat rather than consequence, so an executive cannot weigh it. Policy contains procedural detail and would need rewriting on every technical change. Accepted risks have no owner. Or the proposal presents a single all-or-nothing plan with no fallback, which is not how funding decisions work.
Third party risk is the section most often thin and most often relevant. Modern organizations depend on suppliers who hold their data, connect to their networks or run their processes, and a security program that stops at the organizational boundary is describing a smaller problem than the one that exists. Naming how suppliers are assessed before onboarding, what is required contractually, how ongoing assurance is obtained and what happens at the end of the relationship turns a program document into one that matches how organizations actually operate.
A useful check: read your recommendations and ask whether each one could be declined. If declining has no stated consequence, the recommendation is not making a case; it is expressing a preference, and executive readers distinguish those instantly.
WGU attaches no grade penalty to a revised and resubmitted performance assessment, so a complete draft should go to the evaluator rather than back to you, and let the evaluator find the last gap faster than you would. If your section also carries an objective assessment, WGU objective assessments are proctored and our boundary is absolute: preparation only, with framework drills, policy writing practice and a candid read on your preassessment result. We will not take your exam, take no part once one begins, and we would refuse portal credentials if they were offered.
Proposal arguing in the wrong currency?
Send the D489 rubric and scenario. We translate risk into consequence, build the register and policy hierarchy, and set word targets per aspect.
Eight mistakes that cost time in D489
- Arguing from threat sophistication. Executives weigh consequence. Translate every risk into loss, obligation or continuity.
- Policy written as procedure. Keep policy durable and push volatile detail into standards beneath it.
- Accepted risk with no owner. Acceptance requires a named person with the authority to accept.
- Single all-or-nothing plan. Offer a phased version and state the residual risk of each option.
- Totals with no components. Show the arithmetic behind cost estimates so they can be interrogated.
- Undated industry figures. Incident cost and frequency data moves annually and varies by sector.
- Ignoring workforce reality. A plan that assumes easy hiring of scarce specialists has a hidden assumption.
- Recommendations that cannot be declined. If there is no stated consequence of saying no, there is no argument.
- Stopping at the organizational boundary. Suppliers hold data and hold access. A program that ignores them has scoped out its largest uncontrolled surface.
Three questions students ask about D489
How does this differ from the undergraduate management course?
Do I need to have managed people?
How much financial detail is expected?
Where D489 sits in WGU's programs
The July 2026 catalog places this code in 1 current WGU program. Open a program page for the complete standard path and term positions. The live Degree Plan remains authoritative after transfer credit, substitutions, and mentor planning.
The assessments, one by one
The public catalog does not publish this course's PA/OA identity or task count. WGU Tutors publishes at most one PA manual per course and only from a WGU-controlled public rubric. Until that source exists, PA help begins from the student's real Course of Study and OA support remains preparation only.