Chapter 37 — Security governance, risk and compliance: operations
Lesson map
Lesson 37 published. Map, example, EX109.
flowchart TD
N0["Learning outcomes"]
N1["37.1 Running the service"]
N2["37.2 Findings to closure"]
N3["37.3 Operational review"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX109"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["37.1 Running the service"]
N2["37.2 Findings to closure"]
N3["37.3 Operational review"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX109"]
[Learning outcomes]
|
v
[37.1 Running the service]
|
v
[37.2 Findings to closure]
|
v
[37.3 Operational review]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX109]
Learning outcomes
You will (1) run the GRC programme as an operational service; (2) manage findings and incidents through closure; (3) review operations regularly.
37.1 Running the service
Nadia shadows Ardwell's security manager for a month. Each week begins with a review of overdue control tasks, new findings and exceptions nearing expiry. Mid-week brings meetings with owners whose controls failed. Month-end brings evidence checks and preparation of indicators. She learns that governance is not an annual project but a continuous service with a rhythm, and that the rhythm itself is a control: when weekly reviews lapse, problems accumulate unseen. The weekly review of exceptions nearing expiry, for instance, stops temporary exceptions turning into permanent gaps.
37.2 Findings to closure
Every finding follows a path: recorded with severity and owner, agreed remediation plan, due date, evidence of fix and verification by someone other than the owner. Nadia tracks twenty open findings and notices that several were marked fixed without evidence. She introduces a rule that only the security analyst can close findings, after checking evidence. Closure rates dip briefly, then recover with real fixes. She learns that closure without verification produces comforting numbers but not reduced risk. The brief dip in closure rates showed how many earlier closures had lacked evidence.
37.3 Operational review
Each quarter, the security manager reviews the programme itself: Are tasks on time? Are findings ageing? Are exceptions growing? Which controls fail repeatedly? Nadia helps prepare the review and notes that patch failures have repeated for three quarters on substation devices. The review escalates this to a design problem rather than an owner problem, leading to a project to replace the devices. She learns that operations data reveal where design, not effort, is the real issue. Replacing the substation devices removes a cause that no amount of owner effort could fix.
Worked example
Nadia observes the weekly rhythm, requires verified closure of findings and helps a quarterly review escalate repeated patch failures to a design problem.
Synthetic case. Findings and reviews are synthetic.
Errors and limits
Verified closure slows reporting. Reviews can become routine.
Exercises
- EX109 — Rhythm as control. Why is the weekly rhythm itself a control? Rubric: 3 = when it lapses problems accumulate unseen;; 2 = rhythm;; 1 = vague;; 0 = none.
- EX110 — Closure rule. Who may close findings under Nadia's rule? Rubric: 3 = only the security analyst after checking evidence;; 2 = analyst;; 1 = owner;; 0 = none.
- EX111 — Repeated failures. What did repeated substation patch failures turn out to be? Rubric: 3 = a design problem leading to device replacement;; 2 = design;; 1 = owner;; 0 = none.
Synthesis
GRC operations need rhythm, verified closure and reviews that find design problems.
Continue studying — chapter 37 of 50
← Chapter 36 (draft) · Course chapter index · Chapter 38 (draft) →