OpenCyber Academy
Professional · Chapter 4 · English
Course code: OCA-028Chapter 04: OCA-028-C004

Chapter 4 — Security governance, risk and compliance: core methods

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 The process"]
  N2["4.2 Appetite"]
  N3["4.3 Treatment decisions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 The process"]
  N2["4.2 Appetite"]
  N3["4.3 Treatment decisions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 The process]
    |
    v
[4.2 Appetite]
    |
    v
[4.3 Treatment decisions]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) run a risk assessment using an established process; (2) link risks to appetite; (3) record treatment decisions.

4.1 The process

Lena learns the risk process described in ISO 31000:2018 and applied to information security in ISO/IEC 27005:2022: establish context, identify risks, analyse and evaluate them, treat them, and monitor and review. She runs an assessment for Marston's mobile banking app with the product owner, IT security and fraud teams. They identify risks such as account takeover, fraudulent payments to new payees and app outages, each described with causes and consequences. Writing each risk as a cause leading to a consequence, such as stolen passwords leading to fraudulent payments to new payees, makes treatments easier to target.

4.2 Appetite

Marston's board has stated a low appetite for member financial loss from fraud and a moderate appetite for short service outages. Lena compares each risk with appetite. Account takeover leading to member losses is above appetite and must be treated. Short app outages fall within appetite if recovered within four hours. She learns that appetite turns analysis into decisions: it tells the organisation which risks need action and which can be accepted. Because the four-hour recovery is the threshold, Marston must also be able to show that it actually recovers within four hours.

4.3 Treatment decisions

For account takeover, the team chooses stronger authentication for new payees and transaction monitoring. The product owner agrees to own the treatment with a target date. For outages, the team accepts the current recovery capability and documents the acceptance. Lena records each decision with its owner, date and reasons. She learns that recorded decisions show regulators and auditors that risks were considered and managed deliberately. Mr. Reyes notes that the documented outage acceptance should name the product owner and be revisited if outages begin to exceed four hours.

Worked example

Lena runs a mobile app risk assessment, compares risks with appetite and records treatment and acceptance decisions.

Synthetic case. Risks and appetite are synthetic; ISO 31000:2018 and ISO/IEC 27005:2022 are real.

Errors and limits

Workshops depend on attendees. Appetite statements can be vague.

Exercises

Synthesis

An established process linked to appetite turns risk analysis into recorded decisions.

Continue studying — chapter 04 of 12

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →

Worked answers

EX016. Establish context, identify, analyse, evaluate, treat, and monitor and review.

EX017. Account takeover leading to member financial losses.

EX018. When recovered within four hours.

EX019. Stronger authentication for new payees and transaction monitoring.

EX020. To show regulators and auditors that risks were considered and managed deliberately.