Chapter 28 — Security governance, risk and compliance: implementation I
Lesson map
Lesson 28 published. Map, example, EX082.
flowchart TD
N0["Learning outcomes"]
N1["28.1 Planning"]
N2["28.2 People and change"]
N3["28.3 Honest status"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX082"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["28.1 Planning"]
N2["28.2 People and change"]
N3["28.3 Honest status"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX082"]
[Learning outcomes]
|
v
[28.1 Planning]
|
v
[28.2 People and change]
|
v
[28.3 Honest status]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX082]
Learning outcomes
You will (1) plan control implementation with owners and milestones; (2) manage change for people affected; (3) track implementation status honestly.
28.1 Planning
Ardwell approves the vendor access broker and the ticketing-based GRC tooling. Nadia helps write the implementation plan: phases, owners, milestones, dependencies and acceptance criteria. Phase one moves the two highest-risk vendors to the broker. Phase two moves the rest. Phase three retires the direct connection and shared passwords. Each phase has a test that must pass before the next starts. She learns that phased plans reduce risk, because problems appear while the scope is still small. Starting with the two highest-risk vendors means the riskiest connections are brokered first, before the scope widens.
28.2 People and change
New controls change people's work. Vendor technicians must learn new sign-ins, and on-call engineers must approve sessions at night. Nadia helps prepare short guides, a test session for each vendor and a contact for problems. She records concerns, such as approval fatigue at night, and the responses, such as allowing pre-approved maintenance windows. She learns that adoption problems are often treated as user resistance when they are really design issues that the implementation team can fix. Pre-approved maintenance windows reduce night approvals without removing the record of each session.
28.3 Honest status
Nadia builds a status report showing each milestone as complete, on track, at risk or late, with reasons. When one vendor's equipment cannot support the broker, she marks the milestone late and records a temporary compensating control: supervised sessions with an Ardwell engineer present. Prof. Brenner praises the honest status. He notes that reporting everything as green until the deadline is a common failure, and that boards can only help with problems they are told about in time. The supervised sessions keep that vendor's work traceable until its equipment can be replaced or upgraded.
Worked example
Nadia plans phased implementation, addresses approval fatigue with maintenance windows and reports a late milestone honestly with a compensating control.
Synthetic case. Plans and vendors are synthetic.
Errors and limits
Plans meet surprises. Compensating controls can become permanent.
Exercises
- EX082 — Phase one. What does phase one cover? Rubric: 3 = moving the two highest-risk vendors to the broker;; 2 = two vendors;; 1 = vague;; 0 = none.
- EX083 — Night approvals. How was approval fatigue at night addressed? Rubric: 3 = pre-approved maintenance windows;; 2 = windows;; 1 = vague;; 0 = none.
- EX084 — Compensating control. What compensating control covered the vendor whose equipment could not use the broker? Rubric: 3 = supervised sessions with an Ardwell engineer;; 2 = supervision;; 1 = vague;; 0 = none.
Synthesis
Phased plans, attention to people and honest status reporting make implementation succeed.
Continue studying — chapter 28 of 50
← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →