Chapter 39 — Security governance, risk and compliance: maintainability
Lesson map
Lesson 39 published. Map, example, EX115.
flowchart TD
N0["Learning outcomes"]
N1["39.1 Keeping things current"]
N2["39.2 Framework changes"]
N3["39.3 Knowledge loss"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX115"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["39.1 Keeping things current"]
N2["39.2 Framework changes"]
N3["39.3 Knowledge loss"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX115"]
[Learning outcomes]
|
v
[39.1 Keeping things current]
|
v
[39.2 Framework changes]
|
v
[39.3 Knowledge loss]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX115]
Learning outcomes
You will (1) keep policies, controls and registers current; (2) manage framework edition changes; (3) prevent knowledge loss.
39.1 Keeping things current
A GRC programme decays unless maintained. Policies reference retired systems, controls describe abandoned practices and register entries describe risks that have changed. Nadia sets review dates for every document and control and links them to triggers, such as a major system change or an incident, that force earlier review. She learns that maintainability means designing governance artefacts to be easy to update: short, owned, versioned and linked to the things they describe. An incident trigger, for example, would force review of the vendor access policy after any misuse, not just at its annual date.
39.2 Framework changes
Standards change editions. ISO/IEC 27001 was revised in 2022, reorganising its reference controls into four themes, and NIST CSF moved to version 2.0 in 2024, adding the Govern function. Nadia learns that each change requires a transition plan: compare old and new requirements, update mappings, adjust controls and train staff. Keeping mappings in structured data rather than prose makes transitions much easier, because changes can be traced item by item instead of rewritten from scratch. Ardwell's mapping of controls to ISO/IEC 27001:2022 themes, for instance, can be checked line by line if it is kept as data.
39.3 Knowledge loss
When the security manager announces retirement, Nadia realises much of the programme lives in her head. Together they write short notes on why key decisions were made, which owners need support and where evidence lives. They pair the manager with her successor for two months. Nadia learns that governance knowledge, especially the reasons behind decisions, is easily lost, and that decision records, runbooks and overlapping handovers are maintainability controls in their own right. The decision record for the vendor broker, for example, explains choices her successor might otherwise reverse.
Worked example
Nadia links reviews to triggers, plans transitions for framework editions and captures knowledge before a key retirement.
Synthetic case. Ardwell's documents are synthetic; edition facts for ISO/IEC 27001 and CSF are real.
Errors and limits
Triggers are missed. Handover notes are incomplete.
Exercises
- EX115 — Review triggers. What triggers early review of governance documents? Rubric: 3 = major system changes or incidents;; 2 = triggers;; 1 = vague;; 0 = none.
- EX116 — CSF change. What did NIST CSF 2.0 add? Rubric: 3 = the Govern function;; 2 = Govern;; 1 = vague;; 0 = none.
- EX117 — Handover measure. Which measure protects against loss of the retiring manager's knowledge? Rubric: 3 = decision notes and a two-month paired handover;; 2 = handover;; 1 = vague;; 0 = none.
Synthesis
Maintainable governance is short, owned, versioned and resilient to edition changes and staff turnover.
Continue studying — chapter 39 of 50
← Chapter 38 (draft) · Course chapter index · Chapter 40 (draft) →