Chapter 2 — Security governance and the management system
Lesson map
Lesson 02 published. Map, example, EX006.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Governance structure"]
N2["2.2 Management system concepts"]
N3["2.3 Risk appetite"]
N4["2.4 Scope"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX006"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Governance structure"]
N2["2.2 Management system concepts"]
N3["2.3 Risk appetite"]
N4["2.4 Scope"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]
[Learning outcomes]
|
v
[2.1 Governance structure]
|
v
[2.2 Management system concepts]
|
v
[2.3 Risk appetite]
|
v
[2.4 Scope]
|
v
[Worked example] --> [Exercise EX006]
Learning outcomes
You will (1) design a governance structure for security; (2) apply ISO/IEC 27001 management system concepts; (3) set risk appetite with a board.
2.1 Governance structure
Moorfield's board consists of three dentist partners and two investor representatives. Security decisions have been made informally by Elena and the operations director. Elena proposes a structure: the board approves policy and risk appetite each year, a security committee of Elena, the operations director and a clinical lead meets monthly and clinic managers are accountable for local controls. Dr. Qureshi notes that clear roles make it obvious who decides, who acts and who must be told. The board approves the structure at its next quarterly meeting.
2.2 Management system concepts
Elena studies ISO/IEC 27001:2022, which sets requirements for an information security management system. It asks the organisation to understand its context and interested parties, obtain leadership commitment, assess and treat risks, provide resources, operate controls, evaluate performance and improve. ISO/IEC 27000:2026 gives the overview of the family and its terms. Elena realises that Moorfield already does many of these activities but without records, so it cannot show they happen consistently. She lists Moorfield's existing activities against each clause and marks which have records, which have partial records and which have none at all.
2.3 Risk appetite
Elena drafts a risk appetite statement for the board. Moorfield will accept very low risk to patient record confidentiality, low risk of clinical systems being unavailable during opening hours and moderate risk for administrative systems such as marketing. The board debates the wording and adds that no clinic should be unable to treat patients for more than half a day. Dr. Qureshi notes that appetite statements turn values into rules for prioritising work. The final statement fits on one page and is signed by the board chair.
2.4 Scope
Elena defines the scope of Moorfield's management system: all clinics, the head office, the patient record system, imaging systems and payment processing. The dental laboratory, run by a separate company, is excluded but treated as a supplier. She writes the scope in one paragraph with a diagram. Dr. Qureshi warns that unclear scope causes confusion later, especially when an auditor or insurer asks what the programme actually covers. The board approves the scope, and Elena adds it to the front of the security programme document so everyone reading the programme knows what it covers.
Worked example
Elena designs a board, committee and clinic-manager structure, maps Moorfield to ISO/IEC 27001 concepts, drafts a risk appetite with a half-day clinical limit and defines scope.
Synthetic case. Board arrangements are synthetic; standards are paraphrased.
Errors and limits
Activities without records cannot show they happen consistently.
Exercises
- EX006 — Committee members. Who sits on the security committee? Rubric: 3 = Elena, operations director, clinical lead;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX007 — Missing records. What does Moorfield lack despite doing activities? Rubric: 3 = records;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX008 — Board addition. What limit does the board add? Rubric: 3 = no clinic unable to treat patients over half a day;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX009 — Excluded party. What is excluded from scope? Rubric: 3 = the dental laboratory;; 2 = partly correct;; 1 = other;; 0 = none.
- EX010 — Overview standard. Which standard gives the family overview? Rubric: 3 = ISO/IEC 27000:2026;; 2 = partly correct;; 1 = other;; 0 = none.
Continue studying — lesson 02 (chapter 02 of 12)
← Chapter 01 · Course chapter index · Chapter 03 →
Continue to the next authored lesson.