The Developing a CIS Framework-Based Training Syllabus for Venture Capital Firms: A Competency-Driven Approach

The purpose of this study is to develop and validate a role-based cybersecurity training syllabus for
Venture Capital (VC) firms using the CIS Critical Security Controls v8.1 (Implementation Group
1) and an Outcome-Based Education (OBE) approach grounded in a cybersecurity-adapted Training
Needs Assessment (TNA) framework. A mixed-method design was employed. In the qualitative
phase, interviews with IT personnel and senior management were conducted to identify dominant
cybersecurity risks in VC environments. In the quantitative phase, a structured survey was
distributed to VC employees to assess the relevance, clarity, and applicability of the proposed
syllabus. Content validity was evaluated through expert judgment using the Content Validity Ratio
(CVR), while employee acceptance and internal consistency were examined using Cronbach’s
Alpha. The results show that the most critical risks in VC firms are low security awareness, phishing
threats, and compliance-related vulnerabilities. Three CIS IG1 controls—Security Awareness
Training, Malware Defenses, and Incident Response Management—were prioritized as core
content. The final syllabus integrates these controls into role-specific learning outcomes and
assessment strategies aligned with OBE principles. Validation results indicate strong expert
agreement and high employee acceptance, supporting the syllabus as relevant, understandable, and
suitable for implementation in VC firms.