Chapter 12 — Reporting to leadership and next steps
Lesson map
Lesson 12 published. Map, example, EX056.
flowchart TD
N0["Learning outcomes"]
N1["12.1 A one-page report"]
N2["12.2 Six months of progress"]
N3["12.3 The next year"]
N4["12.4 Further study"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX056"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 A one-page report"]
N2["12.2 Six months of progress"]
N3["12.3 The next year"]
N4["12.4 Further study"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX056"]
[Learning outcomes]
|
v
[12.1 A one-page report]
|
v
[12.2 Six months of progress]
|
v
[12.3 The next year]
|
v
[12.4 Further study]
|
v
[Worked example] --> [Exercise EX056]
Learning outcomes
You will (1) report security status in plain language; (2) review six months of progress; (3) plan the next year and further study.
12.1 A one-page report
Daniel prepares a one-page report for the partners each quarter. It shows the top risks and whether each is rising or falling, five measures with their trend, recent incidents in one line each, and up to three decisions needed. The measures are second-factor coverage, laptops meeting the baseline, days to disable leavers, suspicious emails reported and the last successful restore test. Ms. Ashby advises him to put the decisions first, because partners have little time, and to avoid technical terms they would need explained before they could respond.
12.2 Six months of progress
Daniel compares the start of the course with today. Second-factor coverage has risen from 62.9 percent to all people accounts, with service accounts restricted instead. Laptops meeting the baseline went from unknown to 55 of 60 and then to all 60. Leavers are now disabled on their last day. One fraud attempt was stopped and one incident was handled and reported within the legal time limit. Mrs. Pike tells the partners that she now has a clear answer to her original question, and that the next steps are known.
12.3 The next year
Daniel drafts a plan for the next twelve months: complete the file server clean-up and move remaining records to the cloud, repeat the tabletop exercise with a ransomware scenario, review supplier answers, and run awareness sessions on new fraud patterns. He estimates the time and cost of each and asks the partners to choose. Ms. Ashby suggests he also budget time for his own learning, since threats and services change faster than any course can cover, and that he join a local group of security practitioners for support and fresh ideas.
12.4 Further study
Ms. Ashby reviews options with Daniel. He could take a recognised introductory certification to formalise his knowledge, attend short courses on incident handling or cloud security, or move to a longer qualification later. She also recommends the data governance course that follows this one, since much of Daniel's work, such as retention and supplier data handling, overlaps with how organisations manage information as an asset. Daniel decides to start the data governance course next term and to aim for a certification within a year.
Worked example
Daniel writes a one-page quarterly report with decisions first, shows six months of progress from 62.9 percent second-factor coverage to full people coverage, and plans the next year and further study.
Synthetic case. Progress figures are synthetic.
Errors and limits
Reports full of technical detail without clear decisions are often ignored by leadership.
Exercises
- EX056 — Report order. What should come first in the partner report? Rubric: 3 = decisions needed;; 2 = partly correct;; 1 = other;; 0 = none.
- EX057 — Five measures. Name three of the five measures. Rubric: 3 = MFA, baseline, leaver days, reports, restore test;; 2 = three;; 1 = two;; 0 = none.
- EX058 — Coverage change. How did second-factor coverage change? Rubric: 3 = 62.9 percent to all people accounts;; 2 = partly correct;; 1 = partial;; 0 = none.
- EX059 — Next scenario. What scenario will the next tabletop use? Rubric: 3 = ransomware;; 2 = partly correct;; 1 = other;; 0 = none.
- EX060 — Next course. Which course does Daniel take next? Rubric: 3 = data governance;; 2 = partly correct;; 1 = other;; 0 = none.
Continue studying — lesson 12 (chapter 12 of 12)
← Chapter 11 · Course chapter index · Next course via chapter index →
The chapter index leads to the next course in the study path.