Chapter 31 — Security governance, risk and compliance: advanced cases
Lesson map
Lesson 31 published. Map, example, EX091.
flowchart TD
N0["Learning outcomes"]
N1["31.1 Payments"]
N2["31.2 Certification"]
N3["31.3 Assurance types"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX091"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["31.1 Payments"]
N2["31.2 Certification"]
N3["31.3 Assurance types"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX091"]
[Learning outcomes]
|
v
[31.1 Payments]
|
v
[31.2 Certification]
|
v
[31.3 Assurance types]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX091]
Learning outcomes
You will (1) analyse governance in payment and certification contexts; (2) understand scope reduction; (3) compare assurance types.
31.1 Payments
Elmfield takes rent payments by card through a hosted payment page run by a provider. Sofia learns that PCI DSS v4.0 applies to organisations that store, process or transmit cardholder data or could affect its security. By using a hosted page, Elmfield keeps card data off its own systems, greatly reducing its obligations, though it must still protect the website that links to the payment page and confirm the provider's compliance. She learns that architecture choices can shrink compliance scope substantially. Elmfield's chosen architecture also shapes the board's later certification decision, since card data never touch Elmfield's own laptops.
31.2 Certification
Elmfield's board asks whether it should seek ISO/IEC 27001:2022 certification. Sofia lists benefits: tenders from councils increasingly ask for it, and it would discipline the programme. Costs include audit fees, staff time and ongoing surveillance audits. She suggests first operating the management system for a year and measuring progress against the gap assessment, then deciding. She learns that certification is a means, not an end, and should be chosen for clear reasons. Dr. Haddad adds that operating the system for a year will also give Elmfield the evidence auditors would ask for in any certification audit.
31.3 Assurance types
Sofia compares assurance types Elmfield receives from suppliers. Certification shows a management system met a standard at audit. SOC 2 reports, based on the AICPA trust services criteria, describe controls and, in a type two report, test their operation over a period. Questionnaires record what suppliers claim. She learns that each type provides different strength of evidence and that reading the scope and exceptions in a report matters more than its title. A type two report with exceptions in access management, for instance, says more than a clean certificate whose scope excludes the service used.
Worked example
Sofia explains how a hosted payment page reduces PCI DSS scope, weighs certification and compares assurance types.
Synthetic case. Elmfield's choices are synthetic; PCI DSS v4.0, ISO/IEC 27001:2022 and AICPA TSC are real.
Errors and limits
Scope reduction does not remove all duties. Reports vary in scope.
Exercises
- EX091 — Hosted page effect. How does a hosted payment page affect PCI DSS obligations? Rubric: 3 = keeps card data off Elmfield's systems, reducing scope;; 2 = scope;; 1 = vague;; 0 = none.
- EX092 — Certification advice. What did Sofia suggest before deciding on certification? Rubric: 3 = operate the system for a year and measure progress;; 2 = wait;; 1 = vague;; 0 = none.
- EX093 — Type two report. What does a SOC 2 type two report add? Rubric: 3 = tests of control operation over a period;; 2 = operation;; 1 = vague;; 0 = none.
Synthesis
Architecture, certification and assurance choices shape compliance effort and evidence strength.
Continue studying — chapter 31 of 40
← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →