Chapter 2 — Computing systems

Chapter 2 — Computing systems

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Elmfield's systems"]
  N2["2.2 The inventory"]
  N3["2.3 Why first"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Elmfield's systems"]
  N2["2.2 The inventory"]
  N3["2.3 Why first"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Elmfield's systems]
    |
    v
[2.2 The inventory]
    |
    v
[2.3 Why first]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) describe the components of an organisation's IT; (2) build a simple asset inventory; (3) see why inventories come first in governance.

2.1 Elmfield's systems

Sofia visits Elmfield and lists its computing systems: laptops for office staff, tablets for repairs operatives, a file server, a housing management system hosted by a supplier, cloud email, a rent payment page run by a payment provider and a small board portal. She learns that each system has hardware, software, data and people who use it. Understanding these parts helps her see where things could go wrong and who would need to act if they did. The board portal, for instance, holds board papers, so a failure there would need an owner who can decide quickly.

2.2 The inventory

Sofia builds an asset inventory as a table: asset name, type, owner, location, data held and supplier. She finds that nobody owns the board portal and that eleven tablets are missing from the repairs team's list. ISO/IEC 27002:2022 includes guidance on inventories of information and associated assets, and NIST CSF 2.0 places asset management under its Identify function. She learns that an inventory is not paperwork but the map every later control depends on. The eleven missing tablets matter because repairs operatives carry tenant addresses on them into the field.

2.3 Why first

Dr. Haddad explains why governance starts with inventory. Risk assessment needs to know what could be harmed. Access control needs to know which systems to control. Incident response needs to know what to restore. Without an inventory, each of these guesses. Sofia notes that inventories decay as staff buy new devices or adopt new services, so the inventory needs an owner and a review date. She recommends a quarterly check against purchase records and the identity system to catch missing items. Comparing purchase records with the inventory would, for example, have caught the eleven repairs tablets before anyone went looking.

Worked example

Sofia lists Elmfield's systems, builds an inventory with owners, finds an unowned portal and missing tablets and plans quarterly checks.

Synthetic case. Elmfield's systems are synthetic; ISO/IEC 27002:2022 and CSF 2.0 are real.

Errors and limits

Inventories miss shadow IT. Owners may be nominal.

Exercises

• EX004 — Inventory fields. Which fields does Sofia's inventory hold? Rubric: 3 = name, type, owner, location, data held, supplier;; 2 = six fields;; 1 = vague;; 0 = none.
• EX005 — Inventory gaps. What two gaps did the inventory reveal? Rubric: 3 = unowned board portal and eleven missing tablets;; 2 = two gaps;; 1 = vague;; 0 = none.
• EX006 — Decay check. How does Sofia plan to keep the inventory current? Rubric: 3 = quarterly check against purchases and identity records;; 2 = quarterly;; 1 = vague;; 0 = none.

Synthesis

An owned, current inventory is the map on which all governance depends.

Continue studying — chapter 02 of 40

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →