For Students Starting the MSIS in Fall 2017 (MS29)

The MSIS curriculum consists of three main components: the core courses, restricted electives, and the curriculum option. The core courses establish the necessary background and a common competence level, and the restricted elective courses build upon the core. Students can choose from a wide variety of technical and management elective courses according to their interests and career needs.

Core Course Requirements 72 units
Restricted Electives 36 units
Curriculum Option  36 units
Total  144 units 

Please Note: Students that choose the Cyber Forensics and Incident Response Track do not add any additional units. The forensics track consists of 48 units, which will be fulfilled by one security elective (12 units) and the curriculum option (36 units). All INI students are required to complete a summer internship as part of their degree program. 

Disclaimer: The INI cannot guarantee that courses will be offered each semester or in a specific semester as advertised below.  Students must refer to the 'Schedule of Classes' to determine course availability. The INI cannot guarantee that a student will be offered a seat in a specific course.  These apply to courses at the INI as well as other departments at Carnegie Mellon. In addition, it is the sole responsibility of the student to read and understand the following information regarding this program and its requirements. Should an individual have any further questions, they are encouraged to contact Enrollment Services at ini-enrollment@andrew.cmu.edu for assistance.

Core Courses - 72 units - Core Courses May Not Be Waived.

Core Management Requirements - 12 units

Students must take each of the following classes in order to fulfill the management core courses:

  • 14-782 Information Security Risk Management I (SPRING)
  • 14-784 Information Security Risk Management II OR 14-788 Information Security Policy and Management (SPRING)
    Prerequisite: 95-710 Economic Analysis or equivalent coursework.

Core Networking and Systems Requirements - 24 units

Students must select an option from both of the following networking and systems requirements:

15-641 Computer Networks (FALL)
Prerequisite: 15-513 Introduction to Computer Systems (SUMMER, FALL or SPRING) or 18-600 Foundations of Computer Systems.
OR
14-740 Fundamentals of Telecommunications and Computer Networks (FALL or SPRING)
Note, this class has limited enrollment.
OR
18-756 Packet Switching and
Computer Networks (FALL)
Prerequisite: Either prior networking coursework or 18-345 Introduction to Telecommunication Networks (SPRING)
AND
14-736 Distributed Systems: Techniques, Infrastructure, and Services   (SPRING)
OR
18-746 Storage Systems (FALL)
OR
  15-605 Operating System Design and Implementation (FALL or SPRING) 
Prerequisite: 15-513 Introduction to Computer Systems (SUMMER, FALL or SPRING) or 18-600 Foundations of Computer Systems. Students must receive at least a 'B' in 15-513 to be eligible to take 15-605, with priority given to those who receive an 'A'.   

Core Security Requirements - 36 units

Students must take each of the following three classes in order to fulfill the security core courses:

18-730 Introduction to Computer Security (FALL),
prerequisite to 18-731 Network Security, 18-732 Secure Software Systems and 18-733 Applied Cryptography.
OR
14-741 Introduction to Information Security (FALL), prerequisite to 18-731 Network Security and 18-732 Secure Software Systems
AND
18-731 Network Security (SPRING)
OR
18-732 Secure Software Systems (SPRING)
OR
18-733 Applied Cryptography (SPRING) OR 18-734 Foundation of Privacy (FALL)
AND
One additional graduate-level security course, including
courses from another department (CS, ECE, EPP, Heinz, Tepper)
Note, course must be approved by the MSIS program advisor.

Here is a list (not exhaustive) of approved courses that fulfill the requirement of one additional graduate-level security course:

  • 14-735 Secure Coding
  • 14-761 Applied Information Assurance
  • 14-819 Introduction to Software Reverse-Engineering
  • 14-822 Host Based Forensics
  • 14-823 Network Forensics
  • 14-829 Mobile Security
  • 18-731 Network Security
  • 18-732 Secure Software Systems
  • 18-733 Applied Cryptography
  • 18-734 Foundation of Privacy

If you pick a course that is not listed above, you must receive prior approval from the MSIS academic advisor.

Restricted Electives - 36 units

Students have the opportunity to pursue a wide range of electives in which they have a special interest. Of the 36 units required, 12 units must be from the INI (14-XXX), ECE (18-XXX) or CS (15-XXX) that are numbered 300 above -OR- one of the following EPP courses (19-608, 19-682, 19-712, 19-713 or 19-784).

The remaining 24 units can be fulfilled by any approved courses in the Heinz College or Tepper School or any courses* in ECE, EPP, School of Computer Science, INI or III (49-xxx) that are numbered 300 or above.

Restricted electives may not be taken as pass/no pass/audit. In addition, students should select restricted electives that complement the core curriculum. Note, only up to 36 units of undergraduate courses (300-599) can be considered toward degree requirements (between core and restricted elective courses).

Please refer to the list of approved Heinz College courses for INI students.

*Some exceptions apply. Exceptions are noted in the INI Student Handbook. Please refer to the Enrollment & Registration section of the student handbook under item 10. Courses Outside Degree Requirements. If you have any concern as to whether a course can count towards your degree requirements, please consult with the INI Academic Affairs Office.

15-513: Introduction to Computer Systems Clarification

You may take 15-513: Introduction to Computer Systems the summer before you matriculate if you intend to take courses that require 15-513 as a prerequisite in the first fall semester. We recommend you do this only if the material in this course is a review for you and you intend to enroll in a course with 15-513 as a prerequisite in your first semester.

If you have not taken a similar course before or do not intend to take a course with 15-513 as a prerequisite, we strongly recommend completing 15-513 once you matriculate as an INI student. This is a challenging course, and it is helpful to have access to resources on campus when completing it. 

As an alternative to 15-513, INI students can also take 18-600: Foundations of Computer Systems. 

If 15-513 is completed in the summer prior to matriculation, the final grade will not be calculated into your cumulative GPA. If 15-513 is completed during your program (Fall I, Spring I, Summer I, Fall II, Spring II) it will be calculated into your cumulative GPA. Regardless of whether taken in the summer as a pre-matriculated student or as a current INI student, 15-513 can be counted as a restricted elective towards degree requirements.

Curriculum Option - 36 units

The curriculum option must be chosen before the end of the first fall semester. Students choose either a Professional Track or Research Track:

  • Professional Track: Either 1) course option - a set of courses that will equip students with the knowledge and skills they need to succeed in industry; or 2) development-based project - a project that allows students to build up knowledge and skills in delivering successful solutions for industry.
  • Research Track: Thesis research paper that will allow students to delve deep into a problem and create a solution for a research-based project, providing the opportunity to gain significant knowledge and skills in a particular area.

For Students in the Cyber Forensics and Incident Response Track


The Cyber Forensics and Incident Response Track is made up of the following courses:

  • 14-761 Applied Information Assurance (prerequisite to all other track courses) (FALL or SPRING)
  • 14-822 Host-Based Forensics (SPRING)
  • 14-823 Network Forensics (FALL)
  • 14-832 Cyber Forensics and Incident Response Capstone (SPRING)

View the course descriptions.