Chapter 10 — Governance and reporting
Lesson map
Lesson 10 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Reporting"]
N2["10.2 Standards"]
N3["10.3 Reviews"]
N4["10.4 Roles"]
N5["Budgeting"]
N6["Regulatory context and auditor questions"]
N7["A one-page roadmap"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Reporting"]
N2["10.2 Standards"]
N3["10.3 Reviews"]
N4["10.4 Roles"]
N5["Budgeting"]
N6["Regulatory context and auditor questions"]
N7["A one-page roadmap"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX046"]
[Learning outcomes]
|
v
[10.1 Reporting]
|
v
[10.2 Standards]
|
v
[10.3 Reviews]
|
v
[10.4 Roles]
|
v
[Budgeting]
|
v
[Regulatory context and auditor questions]
|
v
[A one-page roadmap]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) report to leadership; (2) align with standards; (3) plan reviews.
10.1 Reporting
A quarterly one-page report shows unsupported count, exceptions in date, compliance and patch latency. Keeping the report to one page makes it readable for clinic managers and Kestrel's directors, who need to know whether risk is falling, not how each setting is configured. Each measure uses the same definition every quarter, so changes are comparable. Priya adds a short note on the actions behind any change and the decisions needed, such as renewing an exception or funding a replacement. The supplier provides the figures, and the operations manager checks and signs the report before it goes to the directors.
10.2 Standards
Priya maps the work to CIS Controls v8 implementation group 1 and NIST SP 800-53 families CM, SI and SA, so auditors see recognised structure. The mapping shows auditors and future staff where Kestrel's practices come from: the inventory relates to CIS asset safeguards, the baseline to configuration management, patching to system integrity and the exception register to SA-22. It does not claim full compliance with either framework. Priya lists the gaps, such as monitoring that covers only a few events. Mapping also makes it easier to check later whether a practice has lapsed.
10.3 Reviews
The exception register and baseline are reviewed quarterly, the plan yearly. Quarterly review of the register and baseline matches the reporting cycle and the expiry dates of exceptions. The operations manager chairs the review, with the supplier attending. Each meeting checks expiries, compensating controls and any drift that led to a baseline change. The yearly review of the plan looks further ahead: vendor support dates, budget for replacements and whether the targets still fit Kestrel's clinics. Each review's decisions are recorded with dates. Priya leaves a template agenda so that reviews continue after her project ends.
10.4 Roles
The supplier operates, the operations manager owns risk, and Priya's handover names successors. Separating operation from ownership keeps the decision to accept risk with Kestrel, while the supplier keeps systems running. Priya's handover names who maintains the inventory, who chairs reviews, who approves exceptions and who prepares the quarterly report, with a deputy for each. Without named successors, the governance she built would depend on her and would be likely to lapse after her project ends. The operations manager signs the handover document, and the supplier receives a copy.
Budgeting
Leaders approve what they understand and can afford. Priya presents costs in three groups: one-off replacement of imaging PCs, recurring licences, and staff time. She shows that the replacement cost is spread over two financial years, matching the vendor's release schedule. This makes the request realistic rather than an alarming single figure.
She also shows what is not being funded, such as a full security operations service, and the risk that remains as a result. Leaders can then make an informed decision rather than assuming everything is covered.
Regulatory context and auditor questions
Dental practices hold health data and must meet data protection duties, including reporting certain breaches within set time limits. Priya does not give legal advice. Instead she lists the questions for the practice's data protection officer, such as which endpoint events need notification and who decides, and records the answers in the incident procedure. She also prepares short answers to the questions auditors usually ask: how is the inventory kept, how are exceptions approved, how is patching measured. Each answer points to a specific document and a recent example, so that an audit becomes a matter of showing evidence rather than writing explanations from memory.
A one-page roadmap
Leaders need to see where the programme is going without reading technical detail. The final governance item is a one-page roadmap set out quarter by quarter: which imaging PCs are replaced, when the exception register and baseline are reviewed, and when measures are reported. Each line names an owner. The roadmap is updated after each quarterly report, and items that slip are shown as slipped rather than silently moved. This gives the operations manager a simple way to track commitments, and it gives the supplier a clear schedule to plan engineer visits and budget against, which matters when vendor dependencies drive the timeline.
Worked example
The first quarterly report shows unsupported systems falling from 12 to 7.
Synthetic case. Figures are synthetic.
Errors and limits
Reports full of jargon go unread; keep them short and plain.
Exercises
- EX046 — Report measures. Choose four report measures. Rubric: 3 = four relevant;; 2 = three;; 1 = fewer;; 0 = none.
- EX047 — Mapping value. Why map to CIS and NIST? Rubric: 3 = recognised structure for auditors;; 2 = vague;; 1 = minimal attempt;; 0 = none.
- EX048 — Ownership. Why separate operator and owner? Rubric: 3 = accountability;; 2 = vague;; 1 = minimal attempt;; 0 = none.
- EX049 — Review frequency. Justify quarterly exception reviews. Rubric: 3 = matches expiry periods;; 2 = vague;; 1 = minimal attempt;; 0 = none.
- EX050 — Plain language. Rewrite "SA-22 residual risk" for leaders. Rubric: 3 = plain sentence;; 2 = partial;; 1 = vague;; 0 = none.
Synthesis
Governance keeps improvements alive after the project.
Continue studying — chapter 10 of 12
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →