Chapter 20 — Security governance, risk and compliance: engineering context

Lesson map

Lesson 20 published. Map, example, EX058.

flowchart TD
  N0["Learning outcomes"]
  N1["20.1 Three related disciplines"]
  N2["20.2 Place in the organisation"]
  N3["20.3 Obligations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX058"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["20.1 Three related disciplines"]
  N2["20.2 Place in the organisation"]
  N3["20.3 Obligations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX058"]

[Learning outcomes]
    |
    v
[20.1 Three related disciplines]
    |
    v
[20.2 Place in the organisation]
    |
    v
[20.3 Obligations]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX058]

Learning outcomes

You will (1) define governance, risk management and compliance and how they relate; (2) place them in Ardwell's organisation; (3) identify the obligations that shape the programme.

20.1 Three related disciplines

Nadia now begins the core GRC courses. Governance sets direction, accountability and oversight: who decides, what the appetite for risk is and how performance is monitored. Risk management identifies, analyses, evaluates and treats risks, following a process like the one described in ISO 31000:2018. Compliance ensures the organisation meets obligations from law, regulation, contracts and adopted standards. They overlap but differ. COBIT 2019 separates governance, which evaluates, directs and monitors, from management, which plans, builds, runs and monitors. At Ardwell, the board's quarterly review of reports is governance in COBIT's sense, while the security manager running the risk process is management.

20.2 Place in the organisation

At Ardwell, the board approves risk appetite and receives quarterly reports. An information security manager runs the risk process and reports through the chief operating officer. Compliance obligations sit with a legal and compliance officer, while internal audit provides independent assurance to the board's audit committee. Nadia draws these relationships and notes that clear reporting lines prevent conflicts of interest, such as the person running controls also judging whether they work, which would weaken assurance. Internal audit reporting to the audit committee, rather than to the chief operating officer, is what keeps its assurance independent.

20.3 Obligations

Nadia lists Ardwell's obligations. Card payments bring PCI DSS v4.0 through contracts with its bank. Personal data of customers bring data protection law. As an energy distributor, Ardwell faces sector rules on resilience and incident reporting. The board has also chosen to align with ISO/IEC 27001:2022 and to use NIST CSF 2.0 for reporting. She separates mandatory obligations from voluntary choices, because penalties and flexibility differ, and records the source and owner of each in an obligations register. PCI DSS v4.0 arrives through the bank contract, so its owner needs to be someone who manages that contract relationship.

Worked example

Nadia defines governance, risk management and compliance, maps Ardwell's reporting lines and builds an obligations register.

Synthetic case. Ardwell's structure is synthetic; ISO 31000:2018, COBIT 2019, PCI DSS v4.0 and CSF 2.0 are real.

Errors and limits

Legal obligations need legal review. Roles differ between organisations.

Exercises

• EX058 — Governance role. What does governance set?
  Show marking criteria

  Rubric: 3 = direction, accountability and oversight;; 2 = direction;; 1 = vague;; 0 = none.
• EX059 — Independence. Why should the person running controls not judge whether they work?
  Show marking criteria

  Rubric: 3 = it creates a conflict of interest that weakens assurance;; 2 = independence;; 1 = vague;; 0 = none.
• EX060 — Mandatory or voluntary. Is Ardwell's alignment with ISO/IEC 27001:2022 mandatory?
  Show marking criteria

  Rubric: 3 = no, a board choice;; 2 = voluntary;; 1 = mandatory;; 0 = none.

Synthesis

Governance, risk management and compliance are distinct disciplines joined by clear roles and obligations.

Continue studying — chapter 20 of 50

← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →