OpenCyber Academy
Postgraduate · Chapter 5 · English
Course code: OCA-143Chapter 05: OCA-143-C005

Chapter 5 — Security governance, risk and compliance: design alternatives

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 05 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Three alternatives"]
  N2["5.2 Comparison"]
  N3["5.3 Selection"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Three alternatives"]
  N2["5.2 Comparison"]
  N3["5.3 Selection"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX021"]

[Learning outcomes]
    |
    v
[5.1 Three alternatives]
    |
    v
[5.2 Comparison]
    |
    v
[5.3 Selection]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) design alternative approaches to supplier oversight; (2) compare them on effectiveness, cost and burden; (3) select an approach for evaluation.

5.1 Three alternatives

Halbrook oversees three hundred suppliers using one long questionnaire for all. Daniel designs alternatives. The first keeps the questionnaire but adds follow-up interviews for key suppliers. The second introduces tiering: suppliers are classified by data access, criticality and connectivity, with deep reviews for high tiers relying on SOC 2 type two reports or ISO/IEC 27001:2022 certificates plus targeted questions, and light reviews for others. The third buys an external rating service. Each alternative must be judged against the same criteria, which the next section sets out.

5.2 Comparison

Daniel compares alternatives on criteria agreed with procurement and security: depth of assurance for critical suppliers, review time, burden on suppliers, cost and fit with regulatory expectations for outsourcing. The interview option adds depth but increases time. The rating service is fast but gives outside-in views that miss internal controls. Tiering concentrates effort where it matters and reuses existing assurance reports. He records scores and reasoning in a table that colleagues can challenge. Dr. Varga points out that a written score table also lets procurement see why the interview option lost despite its depth.

5.3 Selection

The committee selects tiering for a controlled evaluation before full rollout. Daniel notes that the rating service could complement tiering by flagging changes between reviews, and records it as a possible later addition. He also defines what success would mean: faster reviews without losing depth for critical suppliers. He learns that selecting an approach for evaluation, rather than declaring it the answer, keeps the organisation open to evidence and reduces the cost of being wrong. The success definition is set before the trial so the results cannot be reinterpreted afterwards to favour tiering.

Worked example

Daniel designs three supplier oversight alternatives, compares them on five criteria and selects tiering for evaluation.

Synthetic case. Alternatives and scores are synthetic; SOC 2 and ISO/IEC 27001:2022 are real.

Errors and limits

Criteria weights are subjective. Rating services vary in quality.

Exercises

Synthesis

Designing alternatives and evaluating the chosen one guards against expensive mistakes.

Continue studying — chapter 05 of 12

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →

Worked answers

EX021. With one long questionnaire for all three hundred suppliers.

EX022. SOC 2 type two reports or ISO/IEC 27001:2022 certificates, plus targeted questions.

EX023. It gives outside-in views that miss internal controls.

EX024. Faster reviews without losing depth for critical suppliers.

EX025. Because it keeps decisions open to evidence and reduces the cost of being wrong.