Chapter 29 — Security governance, risk and compliance: operations

Lesson map

Lesson 29 published. Map, example, EX085.

flowchart TD
  N0["Learning outcomes"]
  N1["29.1 Governance calendar"]
  N2["29.2 Tracking actions"]
  N3["29.3 Board reporting"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX085"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["29.1 Governance calendar"]
  N2["29.2 Tracking actions"]
  N3["29.3 Board reporting"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX085"]

[Learning outcomes]
    |
    v
[29.1 Governance calendar]
    |
    v
[29.2 Tracking actions]
    |
    v
[29.3 Board reporting]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX085]

Learning outcomes

You will (1) run a governance calendar; (2) track actions to completion; (3) report to the board.

29.1 Governance calendar

Sofia helps Elmfield set a governance calendar. Monthly: review security alerts and incidents. Quarterly: access reviews, risk register review and supplier checks. Twice a year: board report. Annually: policy review, backup restore test and gap reassessment. Each activity has an owner and a reminder in the shared calendar. She learns that a calendar turns good intentions into routine, and that small organisations benefit from predictable rhythms because staff can plan around them. Placing the annual backup restore test in the calendar, for example, ensures the lab test from chapter 25 is repeated.

29.2 Tracking actions

Every finding and improvement becomes an action with an owner and a due date in a simple tracker. Sofia reviews the tracker monthly with the director. Overdue actions are discussed, not hidden. After three months, eighteen of twenty-four actions are complete. She learns that tracking is most useful when it prompts conversations about obstacles, such as an owner lacking time or budget, rather than simply listing overdue items. For the six open actions, she notes for each whether the obstacle is time, budget or a missing decision.

29.3 Board reporting

Sofia drafts Elmfield's first board security report. It covers top risks and changes, gap assessment progress, incidents and lessons, overdue actions and decisions requested. It is three pages with plain language. The board asks good questions, especially about supplier risk. Sofia learns that boards engage when reports are short, honest and ask for decisions. A report that only reassures gives the board nothing to govern, which undermines the purpose of oversight. Dr. Haddad notes that the board's questions about supplier risk show the report gave directors enough to challenge.

Worked example

Sofia sets a governance calendar, tracks twenty-four actions with eighteen complete and drafts a three-page board report.

Synthetic case. Actions and reports are synthetic.

Errors and limits

Calendars slip under pressure. Board attention varies.

Exercises

• EX085 — Quarterly items. Which activities are quarterly?
  Show marking criteria

  Rubric: 3 = access reviews, register review, supplier checks;; 2 = three;; 1 = vague;; 0 = none.
• EX086 — Action progress. How many actions were complete after three months?
  Show marking criteria

  Rubric: 3 = eighteen of twenty-four;; 2 = 18/24;; 1 = vague;; 0 = none.
• EX087 — Reassurance problem. Why is a report that only reassures a problem?
  Show marking criteria

  Rubric: 3 = it gives the board nothing to govern;; 2 = no decisions;; 1 = vague;; 0 = none.

Synthesis

A governance calendar, action tracking and decision-focused reports keep the programme running.

Continue studying — chapter 29 of 40

← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →