Chapter 26 — Security governance, risk and compliance: methods II

Lesson map

Lesson 26 published. Map, example, EX076.

flowchart TD
  N0["Learning outcomes"]
  N1["26.1 Gap assessment"]
  N2["26.2 Results"]
  N3["Lab — Achieved CSF 2.0 outcomes by function"]
  N4["26.3 Priorities"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX076"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["26.1 Gap assessment"]
  N2["26.2 Results"]
  N3["Lab — Achieved CSF 2.0 outcomes by function"]
  N4["26.3 Priorities"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX076"]

[Learning outcomes]
    |
    v
[26.1 Gap assessment]
    |
    v
[26.2 Results]
    |
    v
[Lab — Achieved CSF 2.0 outcomes by function]
    |
    v
[26.3 Priorities]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX076]

Learning outcomes

You will (1) run a gap assessment against NIST CSF 2.0; (2) summarise results by function; (3) prioritise improvements.

26.1 Gap assessment

Sofia runs a gap assessment using a sample of outcomes from each NIST CSF 2.0 function: Govern, Identify, Protect, Detect, Respond and Recover. With the IT lead and director, she rates each sampled outcome as achieved or not achieved, based on evidence rather than opinion. For example, an outcome about backups counts as achieved only because of the laboratory test. She records the evidence for each rating so that later reassessments can compare like with like. Tying the backup outcome to the laboratory test means a later rating can be repeated using the same evidence.

26.2 Results

The lab summarises twenty-eight rated outcomes. Protect is strongest at five of six, eighty-three percent. Identify reaches sixty percent. Govern and Respond reach fifty percent. Recover reaches thirty-three percent and Detect is weakest at one of four, twenty-five percent. Overall, fifteen of twenty-eight outcomes are achieved, fifty-four percent. Sofia notes that Elmfield invested in protection but has little ability to notice or recover from incidents, a common pattern in small organisations. With only four Detect outcomes rated, one additional achieved outcome would move that figure by twenty-five points.

Lab — Achieved CSF 2.0 outcomes by function

"""Gap assessment: share of sampled CSF 2.0 outcomes achieved per function (synthetic ratings)."""
ratings = {"Govern": [1,0,0,1,0,1], "Identify": [1,1,0,1,0], "Protect": [1,1,1,0,1,1],
           "Detect": [0,1,0,0], "Respond": [1,0,0,1], "Recover": [0,0,1]}
for f, r in ratings.items(): print(f"{f}: {sum(r)}/{len(r)} = {sum(r)/len(r):.0%}")
t = sum(sum(r) for r in ratings.values()); n = sum(len(r) for r in ratings.values())
print(f"overall {t}/{n} = {t/n:.0%}; weakest {min(ratings, key=lambda f: sum(ratings[f])/len(ratings[f]))}")

Run with python3 lab_gap.py. Verified output:

Govern: 3/6 = 50%
Identify: 3/5 = 60%
Protect: 5/6 = 83%
Detect: 1/4 = 25%
Respond: 2/4 = 50%
Recover: 1/3 = 33%
overall 15/28 = 54%; weakest Detect

26.3 Priorities

Sofia proposes priorities based on the gaps and on risk. Detection comes first: enabling alerts in cloud email and identity services and assigning someone to review them. Recovery comes second: documenting and testing a restore plan for the housing system. Governance improvements, such as approving a risk appetite, follow. She warns that percentages from small samples are rough, so they should guide priorities rather than become targets. The board approves the plan for the coming year. Putting detection first also answers the weakest function in the results, Detect at one of four.

Worked example

Sofia rates twenty-eight CSF outcomes, finds Detect weakest at twenty-five percent and prioritises detection and recovery.

Synthetic case. Ratings are synthetic; CSF 2.0 is real.

Errors and limits

Sampled outcomes are not the whole framework. Binary ratings lose nuance.

Exercises

• EX076 — Rating basis. On what basis are outcomes rated achieved?
  Show marking criteria

  Rubric: 3 = evidence rather than opinion;; 2 = evidence;; 1 = opinion;; 0 = none.
• EX077 — Weakest function. Which function is weakest and at what level?
  Show marking criteria

  Rubric: 3 = Detect, 1/4 = 25%;; 2 = Detect;; 1 = Protect;; 0 = none.
• EX078 — Overall result. What share of outcomes is achieved overall?
  Show marking criteria

  Rubric: 3 = 15/28 = 54%;; 2 = 54%;; 1 = vague;; 0 = none.

Synthesis

Evidence-based gap assessments show where investment is unbalanced and guide priorities.

Continue studying — chapter 26 of 40

← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →