What you’ll learn in this article…
- UT Dallas launched a cybersecurity technology and policy bachelor's in fall 2026.
- BLS projects 21% growth in information security analyst jobs, 2025 to 2035.
- Pass the CISSP early: ISC2 Associates get six years to log experience.
Two routes into cybersecurity: build and break systems, or govern them. UT Dallas now does both in one degree, a Bachelor of Science in cybersecurity technology and policy that opened in fall 2026 through its engineering and policy schools jointly. The Bureau of Labor Statistics projects information security analyst jobs up 21% from 2025 to 2035, about 40,600 added positions.
Policy courses are core to the UT Dallas degree, so expect more time with control frameworks and regulatory language than with code. Employers hiring for those seats want both, and the gap between the two skill sets is where careers stall.
Why Cybersecurity Is Now a Policy Problem, and What UT Dallas' New Degree Signals
A cybersecurity and public policy degree teaches two things at once: how to defend digital systems, and how the laws, regulations and governance structures around them shape that defense. The University of Texas at Dallas just gave that pairing a formal home. Its new Bachelor of Science in cybersecurity technology and policy began in fall 2026, and it is offered jointly by the Erik Jonsson School of Engineering and Computer Science and the School of Economic, Political and Policy Sciences. The Texas Higher Education Coordinating Board approved it.
What the Launch Tells Us
Memduh Tura, the program's co-coordinator, puts it plainly: "Cybersecurity is a public policy problem as much as a technical one." Tura, who also directs UT Dallas' master's program in cyber security, technology and policy, is working alongside computer science leadership. The real signal is that an engineering school and a policy school share one degree. Employers want people who can configure a control and also explain why it satisfies a regulation.
Treat this as a direction marker, not a recommendation of one school. The UT Dallas News Center announcement, dated October 30, 2026, does not make clear whether the degree has an online option, so we can't confirm one. If you need remote study, ask the university directly and look at programs built for distance learners.
The Job Market Behind It
The Bureau of Labor Statistics Occupational Outlook Handbook projects employment of information security analysts to grow 21% from 2025 to 2035.1 That means about 40,600 added jobs, taking employment from 192,900 to 233,400.1 BLS also expects roughly 14,100 openings a year, which includes replacements as well as growth.1 The median annual wage was $129,180 in May 2025.1 These are national figures for one occupation, so policy-adjacent roles such as GRC or compliance may differ.
What to Take Away
When you compare online programs and certifications, look past the lab list. Check whether the curriculum covers legal, ethical and governance content alongside hands-on security work. A program with both prepares you for the full range of roles the field is growing into.
What a Cybersecurity and Public Policy Degree Actually Covers
Online cybersecurity education is splitting into two camps, programs that teach you to build and break systems, and programs that teach you to govern them, and the most interesting degrees now try to do both.
The Two Halves of the Degree
The technical core usually covers networks, secure systems, digital forensics and auditing. The policy core covers law, ethics, governance and risk management. A typical semester might pair a secure-systems course and a forensics course with one on regulations and one on risk assessment. The balance varies. Policy-first degrees lean heavily on the second half, while hybrid degrees keep more hands-on work in the mix.
A Concrete Example: UNH Online
The University of New Hampshire's online-only M.S. in Cybersecurity Policy and Risk Management requires at least 30 graduate credits: nine 3-credit core courses plus a 3-credit concluding experience. Terms run eight weeks, with five per academic year. UNH says students can finish in as few as 12 months, which is a best case, not a typical timeline for someone studying part-time around a job. Sample core courses include:
- CPRM 810 Foundations of Cybersecurity Policy
- CPRM 820 Policy Development and Communication
- CPRM 840 Cybersecurity Standards, Regulations, and Laws
- CPRM 870 Cybersecurity Risk Management
The capstone is CPRM 898, a custom project built around a real-world or work-related security challenge. The catalog also lists CPRM 899, a thesis option, for the same 3 credits. UNH lists the courses as asynchronous, so you can set your own study schedule.
Comparing Other Online Options
ASU Online and Georgia Tech both publish credit counts and per-credit tuition for their online cybersecurity degrees, while this research found no UC Berkeley program with published tuition and credit data. ASU Online's version is a 9-credit cybersecurity concentration across three courses, with a stated $15,000 total cost for the degree. Pull those details from each program's own page and line them up against UNH's numbers before you compare.
Read the Course List, Not the Title
Programs label themselves policy, governance, risk or management, and the names don't reliably tell you what you'll study. Open the curriculum and check that it includes at least a few courses from each half: something technical you'd practice, and something legal or regulatory you'd write about.
Cybersecurity Policy vs. Technical Cybersecurity Degrees: Where the Math and Coding Load Differ
Both degree types teach you how attacks work and how organizations defend against them. They differ in how much of your time goes to writing code and building systems versus interpreting law, managing risk, and shaping governance. If you would rather design controls and defend decisions than build tools, lean toward policy; if you want to build and break systems, choose the technical track. The patterns below are typical, and individual programs vary, so check each curriculum.
| Factor | Cybersecurity Policy Degree | Technical Cybersecurity Degree |
|---|---|---|
| Core focus | Governance, risk management, compliance, law, ethics, and how security decisions affect organizations and the public | Securing systems, networks, and software through engineering, defense, and testing |
| Math load | Light to moderate. Usually statistics, quantitative risk analysis, and basic economics or data interpretation | Moderate to heavy. Often discrete math, algebra, and sometimes calculus, plus cryptography concepts |
| Coding load | Limited. Scripting basics or reading code may be expected, but little software development | Substantial. Programming courses, scripting for automation, and often systems or secure coding work |
| Typical capstone or projects | Policy memo, risk assessment, compliance gap analysis, incident response plan, or tabletop exercise | Penetration test, secure system build, digital forensics case, or lab-based defense and attack simulation |
| Technical literacy expected | Still required. You should understand networking, encryption, access control, and common attack methods well enough to evaluate controls | Assumed and deepened. You implement and troubleshoot the controls that policy professionals assess |
| Typical roles | Cyber policy analyst, GRC analyst, compliance specialist, risk analyst, policy advisor | Security analyst, security engineer, penetration tester, digital forensics specialist, systems architect |
| Pay context | Varies by role, sector, and employer, so treat any single number cautiously | BLS reports a median of $124,910 per year for information security analysts (May 2024) |
What Can You Do With a Cybersecurity and Public Policy Degree? Roles and Pay
A cybersecurity and public policy degree points toward roles where technical judgment meets rules, risk and accountability, and those roles travel well across government, defense contractors, finance, healthcare and consulting. The table below pairs each role with what the work involves, who hires for it and a published pay figure from the U.S. Bureau of Labor Statistics (May 2025 data) or Robert Half salary research. Where no reliable published figure exists for a role, we say so rather than estimate.
| Role | What You Do | Typical Employers | Median or Typical Pay (with source) |
|---|---|---|---|
| Information security analyst | Plans and carries out security measures that monitor and protect an organization's computer networks and systems | Computer systems design and related services; finance and insurance; information sector; management of companies and enterprises; government organizations | $129,180 per year, median (U.S. Bureau of Labor Statistics, May 2025) |
| Cybersecurity policy analyst | Analyzes cybersecurity risks and helps develop, implement and monitor the policies and controls that protect information systems | Computer systems design firms; finance and insurance companies; information-sector organizations; corporate enterprises; government organizations | No solid published figure for this specific title |
| GRC analyst | Supports and builds an organization's governance, risk and compliance capability, often within an IT GRC function | Organizations hiring governance, risk and compliance staff, including employers with dedicated IT GRC teams | $75,000 to $95,000 per year (Robert Half) |
| Cybersecurity risk analyst | Assesses threats and vulnerabilities, evaluates security controls and helps organizations reduce cybersecurity risk | Computer systems design and related services; finance and insurance; information sector; management of companies and enterprises; government organizations | No solid published figure for this specific title |
| Compliance officer | Makes sure people and organizations meet legal and regulatory requirements | Organizations across business and financial industries, including regulated companies and government-related employers | $80,730 per year, median (U.S. Bureau of Labor Statistics, May 2025) |
| Regulatory compliance analyst | Reviews organizational activities and controls to confirm they comply with applicable laws, regulations and standards | Businesses subject to legal or regulatory requirements, including financial, corporate and public-sector employers | No solid published figure for this specific title |
| Compliance manager | Leads the effort to ensure an organization meets its legal and regulatory requirements | Regulated businesses; financial organizations; corporate enterprises; government-related organizations | $95,250 to $146,500 per year (Robert Half) |
Can You Study Cyber Policy Without a Computer Science Background?
In most cases, yes: policy-focused master's programs are built with career changers in mind. The usual asks are a bachelor's degree, a GPA around 3.0 to 3.2, and sometimes a light dose of technical or quantitative exposure. Admission is never guaranteed, but a computer science degree is rarely the gate.
What Named Programs Actually Ask For
- UNH Cybersecurity Policy and Risk Management: The catalog lists a 3.2 cumulative GPA and at least 90 undergraduate credits before 800-level courses. No technical degree or prior experience is required, most standardized tests are waived, and the application fee is waived. Two letters are needed.
- UT Dallas MS in Cyber Security, Technology and Policy: The fact sheet lists a baccalaureate and a 3.0 GPA, with no specific prerequisite courses, though undergraduate statistics helps. It says the GRE is not required, while the 2026 catalog describes it as temporarily waived, so confirm before applying. International applicants need a TOEFL iBT score of 80.
- ASU Online MS in Cybersecurity Policy and Management: The program wants a 3.00 GPA and a bachelor's degree. You qualify through a related degree, current related employment, or at least two years of related professional experience. ASU does not say whether an unrelated degree with no related experience is enough, so ask an advisor first.
Requirements shift by term, so check each admissions page before you commit.
Bridge Skills to Build Before You Apply
A few months of preparation makes your statement of purpose more credible and your first semester easier:
- Networking basics: IP addressing, DNS, firewalls, and how traffic moves.
- Intro Python or scripting: Enough to read and tweak simple automation.
- Risk frameworks: Start with the NIST Cybersecurity Framework and its vocabulary.
- Security+ study: Even without sitting the exam, the objectives give you a broad technical map.
Natural On-Ramps
Law, public administration, business, and political science graduates already handle regulation, compliance, and organizational risk. Those skills transfer directly into policy-heavy cyber roles, and the technical gaps are the part you can close with the steps above.
How Does a Career Changer Get From a Non-Technical Background to a Cyber Policy Role?
Most people who land in cyber policy did not start there. The path below shows a common progression, where each stage builds on the one before it. Timelines vary with your starting skills and whether you study full-time or part-time online.
Related Articles
Online and Hybrid Cybersecurity Policy Programs: Format, Admissions and Cost
The estimates below are simple arithmetic: the published per-credit rate multiplied by the required credits (for example, UNH's $640 times 30 credits equals $19,200). They cover tuition only and exclude technology and university fees, books, software, and any travel. Note that Georgia Tech offers a policy specialization inside a technical degree, while ASU's listed option is a computer science concentration rather than a policy-first program, so they suit different goals. Federal student aid, employer tuition assistance, and military or federal-employee education benefits can cut your out-of-pocket cost substantially, so ask your HR office and each school's financial aid team what applies before you enroll. Rates change every year, so confirm current figures on each school's bursar or tuition page. There is no single best online program: if you want deep policy and risk management coursework, UNH's dedicated degree fits; if budget and a technical foundation matter most, Georgia Tech stands out; and your preferred pace (12-month full-time versus multi-year part-time) should break any tie.
| Program | Format and Pacing | Credits | Tuition (per credit / total est.) | Capstone or Practicum |
|---|---|---|---|---|
| University of New Hampshire, M.S. in Cybersecurity Policy and Risk Management | Online only, asynchronous; five 8-week terms per year; full-time in 12 months or part-time in 15 to 36 months | 30 minimum | $640 per credit / about $19,200 (30 x $640) | Required 3-credit capstone project |
| Georgia Tech Online M.S. in Cybersecurity, policy specialization track (Georgia residents) | 100% online, part-time; weekly live faculty office hours | 32 | $373 per credit / about $11,936 (32 x $373); Georgia Tech lists roughly $12,000 | 5-credit practicum project included in the 32 credits |
| Georgia Tech Online M.S. in Cybersecurity, policy specialization track (non-Georgia U.S. and international students) | 100% online, part-time; weekly live faculty office hours | 32 | $387 per credit (U.S. non-Georgia) / about $12,384; $406 per credit (international) / about $12,992 | 5-credit practicum project included in the 32 credits |
| Arizona State University Online, Master's in Cybersecurity (Computer Science concentration) | Online; pacing not listed | 9 concentration credits (three cybersecurity courses); total degree credits not listed | $1,500 per 3-credit course (about $500 per credit) / $15,000 total listed by ASU | N/A |
Questions to Ask Yourself
Certifications That Pair Well: Security+, CGRC, CISSP and More
Security+: The Entry Baseline
CompTIA Security+ is the usual starting point for entry-level security roles, and it has no mandatory experience requirement. CompTIA recommends about two years of hands-on security administration work, but that is guidance, not a gate. It is a foundational cert rather than a dedicated GRC credential. It gives you the vocabulary of controls, threats and operations that policy roles assume you already know. The new V8 exam launches November 17, 2026, so check which version your study materials target before you book.
CGRC: Built for Risk and Compliance Work
ISC2's CGRC is the most direct match for governance, risk and compliance careers. It spans seven domains, the exam costs $599, and it is approved under the Department of Defense 8140 framework, which matters if you are aiming at federal or contractor roles. You need two years of cumulative full-time experience in the exam domains. Part-time work of 20 to 34 hours a week counts (1,040 hours equals six months), and documented internships can count too. Pass without the experience and you become an Associate of ISC2, with three years to earn it.
CISSP: The Senior Management Credential
CISSP is broad rather than GRC-only, and it targets experienced practitioners, managers and executives. The exam costs $749 and requires five years of cumulative full-time work in at least two of its eight domains. An approved degree in computer science, IT or a related field, or another approved ISC2 credential, can cover one of those years. Holders keep it current with 120 continuing education credits every three years and a $135 annual fee.
What Each Credential Adds
A certification gives you a recognized benchmark that HR screens and applicant filters catch instantly, plus evidence that you understand practical security concepts. A degree gives you what a multiple-choice exam can't: depth in law, regulation, economics and policy writing, plus the analytical habits that policy advisor roles reward. The strongest candidates pair both, using the degree for judgment and the cert to clear the filter.
For more options, see our guide to cybersecurity certifications that don't require coding.
You don't need five years of work experience to sit the CISSP. Candidates who pass the exam without it can become an Associate of ISC2 and have up to six years to earn the experience and complete certification, according to ISC2's official CISSP experience requirements and Associate of ISC2 program pages.
How to Evaluate a Program: A Checklist for Online Learners
Plenty of online programs now put "policy" in their names. Use this checklist to tell a program built around governance from a technical degree with one policy course added on.
- Real governance depthLook for dedicated courses in cyber law, ethics, risk management and public policy, not a single elective. If governance appears only once in the course map, the program is technical and is being marketed as policy.
- Hands-on security workConfirm there are virtual labs, a capstone or a practicum where you do actual security tasks. Employers hiring for policy and GRC roles still expect you to understand the systems you are writing rules for.
- Regional accreditationAccreditation applies to the institution, not automatically to each online degree or specialization. Check Department of Education records for the specific school that will award your degree.
- CAE designation for federal or defense goalsThe NSA/DHS Centers of Academic Excellence designation is given to a specific program of study. That program has been reviewed by subject-matter experts against the NICE workforce framework. The designation generally lasts five academic years before the school must reapply. Check NSA's current directory for the exact program and campus. CAE status does not guarantee federal hiring preference or funding. CyberCorps Scholarship for Service also requires attending a participating school and carries a service obligation.
- Transparent cost and outcomesAsk for the full total: tuition, fees and any lab or proctoring charges. Also ask for published outcomes or career services data. If a program cannot share these, treat that as a warning sign.
- Your next stepsShortlist three programs and request syllabi for their policy and lab courses. Then compare each one against the cost table above before you apply.
