Chapter 1 — From audit finding to programme
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Reading the finding"]
N3["1.3 Scope and time"]
N4["1.4 Outcomes"]
N5["1.5 Stakeholders"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Reading the finding"]
N3["1.3 Scope and time"]
N4["1.4 Outcomes"]
N5["1.5 Stakeholders"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 Reading the finding]
|
v
[1.3 Scope and time]
|
v
[1.4 Outcomes]
|
v
[1.5 Stakeholders]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) interpret an audit finding about endpoint hardening; (2) scope a six-month programme; (3) set measurable outcomes.
1.1 The case
Seun Bakare is IT manager at the fictional Marlowe Freight, a logistics company with about 150 staff, 120 office laptops, 40 shared warehouse PCs, 18 Linux servers running route planning and the warehouse system, and 12 Windows servers. Seun is taking the six-month professional programme at the fictional Kingsmere Institute, mentored by Claire Dunmore. The year's external audit found that Marlowe had no documented hardening standard and could not show how many endpoints met one. The cyber insurer's renewal questionnaire asked the same questions, and Seun could only answer "partially".
1.2 Reading the finding
An audit finding is not a list of tasks; it is a statement that evidence is missing. Marlowe almost certainly has many good settings in place, but cannot prove it. The programme must therefore produce both improvements and evidence: a written standard, measurement against it, and a record of exceptions. NIST SP 800-53 Rev. 5 control CM-2 (baseline configuration) and CM-6 (configuration settings) describe exactly this expectation. For Seun, this reframing changes the first month's work: instead of rushing to change settings, he first writes down what Marlowe expects and finds out how far devices meet it.
1.3 Scope and time
Six months is enough to write a standard, measure every device group, close the highest-risk gaps and set up routines, but not to rebuild everything. Seun excludes phones, which are handled by a separate project, and the warehouse handheld scanners, which are vendor-managed, recording both as out of scope with owners. Recording the exclusions with owners stops them looking forgotten. The insurer and auditors can see that phones and scanners are someone's responsibility, even though this programme does not cover them. Claire Dunmore advises Seun to keep the scope fixed unless the operations director agrees a change in writing, because six months leaves no room for drift.
1.4 Outcomes
Seun writes four outcomes: a hardening standard approved by the operations director; monthly coverage figures for each device group; the top risk gaps closed or formally accepted; and an exceptions register reviewed quarterly. Each outcome has a measure and a date. Writing outcomes rather than tasks keeps the programme focused on what the auditors and insurer will check at the end. Each outcome also tells Seun what evidence to keep from the start: the approval record, the monthly figures, the gap list with decisions, and the register with review dates. The three checkpoints in the charter are when progress against each outcome is reported to the operations director.
1.5 Stakeholders
The operations director owns business risk, the warehouse managers own shared PCs, the infrastructure team owns servers, and the finance director cares about the insurance premium. Seun meets each in the first two weeks to explain the programme and what will change for them. Each stakeholder needs something different from the programme: the operations director wants assurance, warehouse managers worry about delays at shift change, the infrastructure team about maintenance windows, and the finance director about the premium. Seun records each concern and returns to it when a decision affects that group, so nobody first hears of a change on the day it happens.
Worked example
Seun turns the audit finding into a one-page charter: problem, scope, four outcomes, owners, and a timeline with three checkpoints at months two, four and six.
Synthetic case. Marlowe Freight, Kingsmere Institute and all people and figures are fictional; data are synthetic.
Errors and limits
Treating an audit finding as a checklist of settings misses the real gap, which is evidence and governance.
Exercises
- EX001 — Evidence gap. Explain why "no documented standard" is a finding even if settings are good. Rubric: 3 = missing evidence and governance;; 2 = documentation;; 1 = vague;; 0 = none.
- EX002 — Control mapping. Which two SP 800-53 controls match the finding? Rubric: 3 = CM-2 and CM-6 explained;; 2 = numbers;; 1 = wrong;; 0 = none.
- EX003 — Scope decisions. Why record out-of-scope items with owners? Rubric: 3 = prevents assumed coverage;; 2 = clarity;; 1 = vague;; 0 = none.
- EX004 — Outcome wording. Rewrite "improve hardening" as a measurable outcome. Rubric: 3 = specific measure and date;; 2 = measurable;; 1 = vague;; 0 = none.
- EX005 — Stakeholder purpose. Why meet the finance director early? Rubric: 3 = insurance and budget interest;; 2 = support;; 1 = vague;; 0 = none.
Synthesis
A clear charter turns an uncomfortable audit finding into a bounded, measurable programme.