Chapter 2 — Security governance, risk and compliance: research frontier

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 The governance frame"]
  N2["2.2 Evidence and argument"]
  N3["2.3 Practice reports"]
  N4["2.4 The gap"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 The governance frame"]
  N2["2.2 Evidence and argument"]
  N3["2.3 Practice reports"]
  N4["2.4 The gap"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX008"]

[Learning outcomes]
    |
    v
[2.1 The governance frame]
    |
    v
[2.2 Evidence and argument]
    |
    v
[2.3 Practice reports]
    |
    v
[2.4 The gap]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes

You will (1) map the research frontier in security risk governance; (2) distinguish claims supported by evidence from claims supported by argument; (3) locate a defensible gap.

2.1 The governance frame

Amara maps how governance shapes risk work. NIST CSF 2.0 added a Govern function covering organisational context, risk management strategy, roles, policy and oversight. ISO/IEC 27001:2022 requires an organisation to define risk criteria, assess and treat information security risks and keep evidence. COBIT 2019 places risk optimisation among governance objectives for boards. ISO 31000:2018 offers principles for risk management in any field. These frameworks agree that risk decisions belong to accountable owners, but they say little about which assessment method produces better decisions. Amara records each source.

2.2 Evidence and argument

Amara sorts the literature by type of support. Gordon and Loeb (2002) offer a mathematical model showing that, under their assumptions, optimal security investment is at most about 37% of the expected loss, which is an argument from a model rather than an observation. Cox (2008) is also analytical. Hubbard and Seiersen (2016) draw on studies of expert calibration from outside security. Spears and Barki (2010) provide survey evidence that user participation in security risk management improves alignment with business processes. Few studies compare assessment methods inside real security programmes.

2.3 Practice reports

Amara also reads practice sources: framework documents, regulator guidance and industry reports. They describe what organisations do but rarely test whether it works. She notes that assessment methods spread by imitation and by auditor expectations, and that a matrix is often chosen because it is easy to explain to a board. This explains why matrices remain common despite analytical critiques: their benefits are social and procedural, while their costs, such as inconsistent priorities, are hard to see without measurement. She notes this tension.

2.4 The gap

Amara defines her gap precisely: there is little published evidence, from inside an operating security programme, on whether calibrated quantitative assessment improves consistency, calibration and treatment choices compared with an ordinal matrix, once training time and board communication are counted as costs. The gap is narrow enough to study in one organisation and important because many regulators and boards are asking whether to move to quantification. Prof. Delgado approves the framing and asks her to state clearly which effects her design cannot detect.

Worked example

Amara maps governance frameworks, separates modelled arguments from empirical evidence and defines a gap in field evidence comparing matrices with calibrated quantification.

Synthetic case. Corvane is synthetic; CSF 2.0, ISO/IEC 27001:2022, COBIT 2019, ISO 31000:2018, Gordon and Loeb (2002), Cox (2008), Hubbard and Seiersen (2016) and Spears and Barki (2010) are real.

Errors and limits

Literature maps date quickly. Practice reports may be selective.

Exercises

• EX008 — Govern function. What did CSF 2.0 add?
  Show marking criteria

  Rubric: 3 = a Govern function;; 2 = Govern;; 1 = Detect;; 0 = none.
• EX009 — Gordon-Loeb result. What upper bound did Gordon and Loeb derive?
  Show marking criteria

  Rubric: 3 = about 37% of expected loss;; 2 = 1/e;; 1 = 100%;; 0 = none.
• EX010 — Spears and Barki. What did Spears and Barki (2010) find?
  Show marking criteria

  Rubric: 3 = user participation improves alignment with business processes;; 2 = participation;; 1 = vague;; 0 = none.
• EX011 — Why matrices persist. Why do matrices remain common?
  Show marking criteria

  Rubric: 3 = easy to explain and expected by auditors;; 2 = social benefits;; 1 = accuracy;; 0 = none.
• EX012 — Defined gap. What gap does Amara study?
  Show marking criteria

  Rubric: 3 = field evidence comparing matrices with calibrated quantification;; 2 = field evidence;; 1 = vague;; 0 = none.
• EX013 — Supervisor request. What did Prof. Delgado ask Amara to state?
  Show marking criteria

  Rubric: 3 = which effects the design cannot detect;; 2 = limits;; 1 = vague;; 0 = none.
• EX014 — Evidence types. Why does Amara sort the literature by type of support?
  Show marking criteria

  Rubric: 3 = models, experiments and practice reports support claims differently;; 2 = evidence strength;; 1 = vague;; 0 = none.

Synthesis

The frontier shows strong argument but thin field evidence, which defines a precise gap.

Continue studying — chapter 02 of 08

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →