Chapter 2 — Security governance, risk and compliance: current practice | Postgraduate Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Security governance, risk and compliance: current practice

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Frameworks in use"]
  N2["2.2 Halbrook's practice"]
  N3["2.3 Trends"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Frameworks in use"]
  N2["2.2 Halbrook's practice"]
  N3["2.3 Trends"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 Frameworks in use]
    |
    v
[2.2 Halbrook's practice]
    |
    v
[2.3 Trends]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) survey current GRC frameworks and their uses; (2) assess Halbrook's practice against them; (3) identify trends shaping the field.

2.1 Frameworks in use

Daniel maps the frameworks used at Halbrook. The security programme follows ISO/IEC 27001:2022 and holds certification. The board receives reports structured by NIST CSF 2.0 functions. Enterprise risk management follows ISO 31000:2018 principles. Internal audit uses COBIT 2019 for IT governance reviews. Suppliers provide SOC 2 reports or ISO certificates. He notes that each framework answers a different question and that mature organisations combine them rather than choosing one. For example, ISO 31000 tells Halbrook how to manage risk, while a supplier's SOC 2 report tells it how far it can rely on that supplier's controls.

2.2 Halbrook's practice

Daniel assesses Halbrook's practice candidly. Policies and certification are mature. Risk assessment uses a five-by-five matrix that the board finds hard to compare with financial risks. Supplier oversight relies on questionnaires that take weeks and are rarely read in depth. Board reporting is long and mostly lists activities. He concludes that Halbrook's weaknesses lie less in controls than in how risk is expressed, how suppliers are overseen and how the board is informed. These three weaknesses become the threads of his later work: loss exceedance reporting, supplier tiering and quantified appetite for the board.

2.3 Trends

Daniel identifies trends: growing interest in quantifying cyber risk in financial terms; regulators expecting boards to oversee cyber risk directly, reflected in the Govern function of NIST CSF 2.0; supply chain risk management becoming central; and continuous control monitoring replacing annual snapshots. He learns that trends should be weighed against the organisation's maturity, and that adopting a fashionable method without the data or skills to support it can make governance worse rather than better. Halbrook, with mature certification but sparse loss data, can adopt quantification only if it starts with a few scenarios and honest ranges.

Worked example

Daniel maps five frameworks in use at Halbrook, finds weaknesses in risk expression, supplier oversight and board reporting and identifies four trends.

Synthetic case. Halbrook's practice is synthetic; frameworks cited are real.

Errors and limits

Trend lists date quickly. Self-assessment can be generous.

Exercises

EX006 — Board structure. Which framework structures Halbrook's board reports? Rubric: 3 = NIST CSF 2.0;; 2 = CSF;; 1 = COBIT;; 0 = none.
EX007 — Matrix problem. Why does the board struggle with the five-by-five matrix? Rubric: 3 = it is hard to compare with financial risks;; 2 = comparability;; 1 = vague;; 0 = none.
EX008 — Supplier weakness. What is weak about supplier oversight? Rubric: 3 = slow questionnaires rarely read in depth;; 2 = questionnaires;; 1 = vague;; 0 = none.
EX009 — Trend caution. Why should trends be weighed against maturity? Rubric: 3 = methods without data or skills can make governance worse;; 2 = maturity;; 1 = vague;; 0 = none.
EX010 — Combining frameworks. Why do mature organisations combine frameworks? Rubric: 3 = each answers a different question;; 2 = complementary;; 1 = vague;; 0 = none.

Synthesis

Current practice combines frameworks; Halbrook's gaps lie in expressing risk, overseeing suppliers and informing the board.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →