Chapter 2 — Security governance, risk and compliance: service and stakeholder context

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Stakeholders"]
  N2["2.2 Expectations"]
  N3["2.3 Programme purpose"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Stakeholders"]
  N2["2.2 Expectations"]
  N3["2.3 Programme purpose"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 Stakeholders]
    |
    v
[2.2 Expectations]
    |
    v
[2.3 Programme purpose]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) identify stakeholders in a credit union's security; (2) map their expectations; (3) define the GRC programme's purpose.

2.1 Stakeholders

Lena maps stakeholders: members who trust Marston with savings, the board elected by members, the financial regulator, the deposit insurer, card schemes through PCI DSS v4.0 obligations, auditors and suppliers such as the core banking provider. Each has expectations about security. Members expect their money and data to be safe. The regulator expects sound risk management and timely incident reporting. Card schemes expect cardholder data protection. She learns that GRC serves many audiences at once. The deposit insurer and the card schemes, for example, will ask for different evidence about the same controls.

2.2 Expectations

Lena lists each stakeholder's expectations, how they are expressed and how Marston shows it meets them. The regulator's expectations come through rules and supervisory visits; Marston shows compliance through policies, risk reports and audit results. The board's expectations come through risk appetite; Marston shows performance through reports. She learns that mapping expectations to evidence reveals where Marston has no clear way to show it meets an expectation. For member expectations, for instance, Marston has no report at all showing that their data are safe, which becomes an early gap to close.

2.3 Programme purpose

With this context, Lena drafts a purpose statement for Marston's GRC programme: to keep security risk within the board's appetite, meet legal and contractual obligations and give members, the board and regulators reliable evidence that their trust is justified. Mr. Reyes asks how she would know if the programme succeeded. She adds measurable outcomes, such as top risks within appetite, no overdue high findings and clean regulatory reviews. Each outcome can be checked quarterly, so the purpose statement becomes something the board can hold the programme to.

Worked example

Lena maps seven stakeholders, links expectations to evidence and drafts a purpose statement with measurable outcomes.

Synthetic case. Marston's context is synthetic; PCI DSS v4.0 is real.

Errors and limits

Stakeholder views change. Purpose statements can be vague.

Exercises

• EX006 — Regulator expectation. What does the regulator expect?
  Show marking criteria

  Rubric: 3 = sound risk management and timely incident reporting;; 2 = expectations;; 1 = vague;; 0 = none.
• EX007 — Card scheme duty. Which obligation comes from card schemes?
  Show marking criteria

  Rubric: 3 = PCI DSS v4.0;; 2 = PCI;; 1 = vague;; 0 = none.
• EX008 — Mapping benefit. What does mapping expectations to evidence reveal?
  Show marking criteria

  Rubric: 3 = expectations Marston cannot yet show it meets;; 2 = gaps;; 1 = vague;; 0 = none.
• EX009 — Programme purpose. What is the purpose of Marston's GRC programme?
  Show marking criteria

  Rubric: 3 = keep risk within appetite, meet obligations, give reliable evidence;; 2 = purpose;; 1 = vague;; 0 = none.
• EX010 — Success outcome. Name one measurable outcome Lena added.
  Show marking criteria

  Rubric: 3 = no overdue high findings;; 2 = outcome;; 1 = vague;; 0 = none.

Synthesis

Stakeholder context defines what the GRC programme must achieve and evidence.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →