Chapter 2 — Standards and context

Chapter 2 — Standards and context

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Guidance to rely on"]
  N2["2.2 Fitting a small firm"]
  N3["2.3 Prioritising"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Guidance to rely on"]
  N2["2.2 Fitting a small firm"]
  N3["2.3 Prioritising"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 Guidance to rely on]
    |
    v
[2.2 Fitting a small firm]
    |
    v
[2.3 Prioritising]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) use recognised guidance; (2) relate it to a small professional firm; (3) prioritise by risk.

2.1 Guidance to rely on

Daniel learns which sources are trustworthy. NIST SP 800-63B sets out authenticator strength, password guidance and recovery. NIST SP 800-207 describes zero trust, where access decisions consider identity, device and context rather than network location. The W3C WebAuthn standard and FIDO2 underpin passkeys. RFC 6749 defines OAuth 2.0 and RFC 9700 gives current OAuth security advice. Helen asks him to cite these rather than vendor blogs, because standards are stable, reviewed and independent of any one product. He keeps a short list of these sources in his notes.

2.2 Fitting a small firm

An accountancy firm cannot adopt everything at once. Daniel reads guidance for its principles: strong authentication for everyone, stronger still for administrators and staff with access to many clients; least privilege; prompt removal of leavers; and evidence that controls work. He relates each principle to Ashby and Lane's systems. He notes that client confidentiality and regulatory duties make unauthorised access to tax records a serious harm, which raises the priority of access controls on those systems. Helen checks his mapping of principles to systems before he presents it.

2.3 Prioritising

Daniel ranks issues by likely harm and effort. High harm and low effort come first: removing leavers, enforcing multi-factor authentication and separating admin accounts. Medium items follow: role-based groups and guest expiry. Longer projects such as single sign-on for the tax software come later. He writes the ranking on one page with reasons and agrees it with Helen and the managing partner. A clear priority list keeps a six-month course focused on the changes that reduce risk most. The list is revisited monthly.

Worked example

Daniel's one-page priority list puts leavers, MFA and admin separation first, then role groups and guest expiry, then SSO for tax software.

Synthetic case. Priorities are synthetic; NIST SP 800-63B, NIST SP 800-207, W3C WebAuthn, RFC 6749 and RFC 9700 are real sources.

Errors and limits

Citing vendor marketing as authority leads to product-driven rather than risk-driven decisions.

Exercises

• EX006 — Zero trust source. Which NIST publication describes zero trust? Rubric: 3 = SP 800-207;; 2 = 800-207;; 1 = 800-63B;; 0 = none.
• EX007 — Passkey standard. Which standard underpins passkeys? Rubric: 3 = W3C WebAuthn with FIDO2;; 2 = WebAuthn;; 1 = SAML;; 0 = none.
• EX008 — Harm driver. Why are tax record controls high priority? Rubric: 3 = client confidentiality and regulatory duties;; 2 = confidentiality;; 1 = cost;; 0 = none.
• EX009 — First items. Which items come first? Rubric: 3 = leavers, MFA, admin separation;; 2 = quick wins;; 1 = SSO;; 0 = none.
• EX010 — Later project. Which project comes later? Rubric: 3 = SSO for tax software;; 2 = SSO;; 1 = MFA;; 0 = none.

Synthesis

Recognised standards, applied by principle and ranked by harm and effort, focus identity work.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →