Chapter 2 — Understanding the firm
Lesson map
Lesson 02 published. Map, example, EX006.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Information inventory"]
N2["2.2 Who depends on it"]
N3["2.3 Security goals"]
N4["2.4 What cannot be lost"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX006"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Information inventory"]
N2["2.2 Who depends on it"]
N3["2.3 Security goals"]
N4["2.4 What cannot be lost"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]
[Learning outcomes]
|
v
[2.1 Information inventory]
|
v
[2.2 Who depends on it]
|
v
[2.3 Security goals]
|
v
[2.4 What cannot be lost]
|
v
[Worked example] --> [Exercise EX006]
Learning outcomes
You will (1) map the information a professional firm holds; (2) identify who depends on it; (3) state what the firm cannot afford to lose.
2.1 Information inventory
Daniel spends his first week listing what Corbridge holds. Client identity documents and bank statements arrive by email and upload portal. Tax returns and payroll calculations live in the accounting software. Engagement letters and working papers sit in shared cloud folders. Staff records live in a payroll service. Older client files, some over ten years old, remain on the office file server. He records each type with its location, owner and rough volume in a spreadsheet, and he notes where the same information is copied into more than one place, because each copy needs protecting.
2.2 Who depends on it
Daniel asks each partner which information they could not work without for a week. The answers cluster around three things: the accounting software during tax season, the email system for client communication, and the client portal for document collection. He also asks reception and the payroll team, who add the phone system and the payroll service. Ms. Ashby explains that dependency is as important as sensitivity. A system holding little personal data can still stop the business if it fails, and that kind of risk is often missed by people who think only about secrecy.
2.3 Security goals
Ms. Ashby introduces the three goals that ISO/IEC 27000:2026 uses to describe information security: confidentiality, integrity and availability. For Corbridge, confidentiality matters most for identity documents and bank statements. Integrity matters most for tax calculations and client bank details used for refunds, because a changed figure or account number causes direct financial harm. Availability matters most in the weeks before filing deadlines, when an outage of even a day causes missed submissions. Daniel adds a column to his inventory marking which goal matters most for each information type, with one sentence explaining why.
2.4 What cannot be lost
Daniel drafts a short statement for Mrs. Pike: the firm cannot afford a leak of client identity documents, a change to client refund bank details, or loss of the accounting software in January. She agrees and adds a fourth item from her own experience: the firm's reputation for discretion, which brings most new clients through referrals. Ms. Ashby tells Daniel that this statement will guide every priority decision for the rest of the course, and that a short list agreed by leadership is worth more than a long list written alone.
Worked example
Daniel inventories Corbridge's information, finds what partners depend on, ties each type to a security goal and agrees four things the firm cannot lose.
Synthetic case. Information types and volumes are synthetic.
Errors and limits
Listing only sensitive data misses systems the business depends on to operate.
Exercises
- EX006 — Three goals. Which three goals does ISO/IEC 27000:2026 use? Rubric: 3 = confidentiality, integrity, availability;; 2 = all three;; 1 = two;; 0 = none.
- EX007 — Integrity example. Give an integrity example at Corbridge. Rubric: 3 = client refund bank details;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX008 — Peak availability. When does availability matter most? Rubric: 3 = weeks before filing deadlines;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX009 — Fourth item. What did Mrs. Pike add to the list? Rubric: 3 = the firm's reputation for discretion;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX010 — Dependency lesson. Why ask about dependency as well as sensitivity? Rubric: 3 = low-sensitivity systems can still stop the business;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 02 (chapter 02 of 12)
← Chapter 01 · Course chapter index · Chapter 03 →
Continue to the next authored lesson.