Chapter 9 — Network and communications security: leadership and assurance

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 What directors need"]
  N2["9.2 Assurance through evidence"]
  N3["9.3 Reporting bad news"]
  N4["9.4 Leading without authority"]
  N5["9.5 Independent assurance"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 What directors need"]
  N2["9.2 Assurance through evidence"]
  N3["9.3 Reporting bad news"]
  N4["9.4 Leading without authority"]
  N5["9.5 Independent assurance"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 What directors need]
    |
    v
[9.2 Assurance through evidence]
    |
    v
[9.3 Reporting bad news]
    |
    v
[9.4 Leading without authority]
    |
    v
[9.5 Independent assurance]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) provide assurance to directors; (2) report risk and progress; (3) lead change without formal authority.

9.1 What directors need

Directors are accountable for the provider's risks but do not configure routers. They need to know whether risks are understood, whether controls work and whether plans are on track. Marta prepares a quarterly assurance report: a one-page summary, three indicators with trends, open risks with owners, and decisions needed. She avoids dense technical detail and keeps supporting evidence in an appendix. Good assurance lets directors ask informed questions and take decisions, rather than simply trusting or doubting the technical team.

9.2 Assurance through evidence

Assurance means confidence based on evidence. For VPNs, Marta reports the share of peers using IKEv2 with certificates, confirmed by negotiated status. For route validation, she reports invalid routes seen, contacts made and incidents avoided. For filtering, she reports customers with matches and how each was resolved. Each figure links to its source data. When a director asks how she knows a figure is correct, she can show the source and method, which is what distinguishes assurance from reassurance. Methods are described in the appendix.

9.3 Reporting bad news

Not all news is good. The partner VPN migration slips by a month because the partner's engineer leaves. Marta reports the delay plainly, with its cause, its effect on risk and the revised plan. She resists the temptation to bury it in an appendix. Directors who hear bad news early can help, perhaps by contacting the partner's management. Reports that only contain good news lose credibility, and directors stop trusting them, which undermines the assurance role entirely. Early warning also gives directors time to adjust related plans.

9.4 Leading without authority

As a placement student, Marta has no authority over the operations team. She leads by preparing clear analysis, listening to the team's concerns, giving credit for their work and making it easy for them to adopt changes. When an engineer disagrees with the validation staging, arguing for faster rejection, she invites him to present his view to the directors alongside hers. Including dissent strengthens decisions and builds trust. Leadership in specialist roles often relies on influence rather than formal power.

9.5 Independent assurance

Internal reports can be biased by those who write them. Marta recommends that, once a year, an engineer from a neighbouring provider reviews the provider's VPN, validation and filtering configurations under a reciprocal arrangement. Independent review finds blind spots and gives directors a second opinion. The arrangement costs little because each provider reviews the other. She drafts terms covering scope, confidentiality and how findings are reported, ensuring the reviewer sees configurations but not customer data. Findings go to the directors as well as the operations team, so they cannot be quietly set aside.

Worked example

The quarterly report has one summary page, three indicators, four open risks and two decisions needed.

Synthetic case. The report is synthetic.

Errors and limits

Assurance reports without traceable evidence become reassurance that directors cannot test.

Exercises

• EX041 — Assurance versus reassurance. What distinguishes assurance from reassurance?
  Show marking criteria

  Rubric: 3 = evidence and method traceable to sources;; 2 = evidence;; 1 = tone;; 0 = none.
• EX042 — Delay reporting. How should the partner migration delay be reported?
  Show marking criteria

  Rubric: 3 = plainly with cause, risk effect and revised plan;; 2 = openly;; 1 = hide;; 0 = none.
• EX043 — Dissent handling. How did Marta handle the engineer who disagreed?
  Show marking criteria

  Rubric: 3 = invited him to present to directors;; 2 = included;; 1 = overruled;; 0 = none.
• EX044 — Reciprocal review. Why use a reciprocal review arrangement?
  Show marking criteria

  Rubric: 3 = independent view at low cost;; 2 = independence;; 1 = compliance;; 0 = none.
• EX045 — Report contents. List four elements of the quarterly report.
  Show marking criteria

  Rubric: 3 = summary, indicators, risks with owners, decisions needed;; 2 = three;; 1 = fewer;; 0 = none.

Synthesis

Evidence-based, honest reporting and influence-based leadership give directors real assurance.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →