Security governance, risk and compliance: foundations and decisions

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 The decision problem"]
  N2["1.2 Start with a service, not a product"]
  N3["1.3 Translate a threat into a business scenario"]
  N4["1.4 Choose outcomes that can be checked"]
  N5["1.5 Set priorities under a real limit"]
  N6["1.6 A short working example"]
  N7["1.7 The one-page strategy test"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 The decision problem"]
  N2["1.2 Start with a service, not a product"]
  N3["1.3 Translate a threat into a business scenario"]
  N4["1.4 Choose outcomes that can be checked"]
  N5["1.5 Set priorities under a real limit"]
  N6["1.6 A short working example"]
  N7["1.7 The one-page strategy test"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]

[Learning outcomes]
    |
    v
[1.1 The decision problem]
    |
    v
[1.2 Start with a service, not a product]
    |
    v
[1.3 Translate a threat into a business scenario]
    |
    v
[1.4 Choose outcomes that can be checked]
    |
    v
[1.5 Set priorities under a real limit]
    |
    v
[1.6 A short working example]
    |
    v
[1.7 The one-page strategy test]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes

After this chapter, a reader should be able to distinguish a business objective from a security activity, explain how a risk scenario affects a service, identify who must own a decision, write a measurable security outcome, and test whether a proposed action belongs in a strategy.

1.1 The decision problem

A security strategy is a set of choices about what the organization will protect, why it matters, what level of disruption or loss it can tolerate, who can decide, and how progress will be checked. It has a time horizon and a resource limit. A list of controls, tools, or standards is useful evidence for a strategy, but the list alone does not explain which outcome matters first.

Consider two proposals: “Buy a new security platform” and “Restore the customer booking service within four hours after a destructive event.” The first is a possible activity. The second is a service outcome. The organization may eventually need a platform, backups, runbooks, training, or a different architecture to meet the outcome. The outcome provides a reason to compare those options. It also creates a test: a timed restoration exercise can show whether the promise is credible.

The NIST Cybersecurity Framework 2.0 offers a useful language for this work. Its six functions are Govern, Identify, Protect, Detect, Respond, and Recover. A strategy uses all six, but Govern is where the organization sets expectations, responsibilities, and risk direction. NIST's small-business quick-start resources illustrate that a modest organization can begin with its own context and priorities rather than a large program copied from another company.

1.2 Start with a service, not a product

Security work has value because it protects a service, a duty, a person, or an asset that matters to the mission. Begin by naming the services in plain language. A payment processor may depend on card authorization, settlement, merchant access, and support. A clinic may depend on appointment booking, medical record access, and laboratory results. The same technology can support several services, and one service can cross multiple vendors and systems.

For each service, capture five facts: the owner, the people affected, the supporting systems and data, the maximum tolerable interruption, and the consequences of failure. The owner is the person accountable for choosing acceptable tradeoffs; the security team provides evidence and options. A credible owner can say whether a four-hour outage matters more than a delayed release, and can approve a recovery exercise that temporarily uses staff time.

Do not make the first inventory perfect. A first pass that names the most important services and unknown dependencies is more useful than a comprehensive spreadsheet whose entries have no owner. Record uncertainty as uncertainty. If the recovery time is guessed, label it as an assumption to validate with the service owner.

1.3 Translate a threat into a business scenario

“Ransomware” is a threat label. “The scheduling service is unavailable for two days because administrators cannot restore its database” is a risk scenario. The scenario can be tested against evidence: backup age, restoration time, separation of administrator accounts, and whether a manual scheduling process exists. It also has a business consequence: delayed service, staff overload, or contractual impact.

A compact scenario has four parts:

1. Condition: the event or weakness that could occur.
2. Service: the business process that would be affected.
3. Consequence: the kind of harm that would follow.
4. Evidence gap: what is not yet known well enough to decide.

For example: “If a compromised administrator account can delete both the live scheduling database and its backups, booking may stop beyond the four-hour target; the team has not run a full restore test this quarter.” The statement does not assert that compromise has happened. It links a plausible condition to a measurable service outcome and a testable gap.

Real incidents show why these distinctions matter. In its public reporting on the 2021 Colonial Pipeline ransomware event, the U.S. Government Accountability Office states that ransomware was deployed against the operator's business systems and discusses the subsequent pipeline security response. The strategic lesson here is an inference: business-system dependencies can affect operational decisions, so service mapping and continuity planning should not stop at the most visible technical system. This book does not infer the incident's detailed root cause from that source.

1.4 Choose outcomes that can be checked

A security outcome describes a state the organization wants to reach. It should have an owner, a date, a boundary, and evidence. “Improve monitoring” has no boundary or success test. “By the end of the quarter, every production identity provider and externally exposed application sends security events to the monitored log store, and a weekly coverage report identifies missing sources” can be checked.

An outcome need not guarantee that no incident will occur. Security teams cannot promise zero attacks or zero loss. They can set clear expectations about capability: detect a class of event within a defined time, restore a service within a tested window, review privileged access on a defined cadence, or resolve critical exposures according to an agreed risk rule. The measurement should use evidence collected during ordinary work rather than numbers invented for a presentation.

Useful measures combine coverage, quality, and effect. Coverage asks whether the target population is included. Quality asks whether a control works under a test. Effect asks whether the service outcome improved. For backups, these might be: percentage of critical services with protected copies; percentage of sampled restores that succeed; and measured time to restore a service. A high backup coverage number cannot substitute for a restore test.

1.5 Set priorities under a real limit

Most teams cannot do everything at once. A strategy therefore needs an explicit prioritization rule. Start with service criticality and exposure, then consider the evidence supporting the scenario, the time required to reduce risk, dependencies, and cost. Use consistent labels such as “act this month,” “plan this quarter,” and “accept for now with an owner and review date.” Avoid false precision: a score of 8.7 is not useful if nobody can explain how it was calculated or what decision changes at 8.7.

An action can be valuable even when it is small. Testing whether backups can be restored may cost less than buying a new tool and reveal the most consequential gap. Conversely, a visible security dashboard may be a poor early investment if no one owns the underlying alerts. Prioritization is a decision about expected reduction of meaningful harm, not a contest to deploy the most controls.

The strategy should name what is deferred and why. An approved deferral is not evidence that the risk disappeared. It records the tradeoff, the owner, the compensating measures, and the date on which the decision will be revisited. The separate NIST Privacy Framework can help when the scenario concerns harms from processing personal data; privacy risk is broader than breach prevention.

1.6 A short working example

The fictional Northstar Community Services runs a public appointment portal, an internal case-management service, and a volunteer roster. Its executive team has one security engineer and limited budget for the next three months. The organization has no confirmed inventory of third-party integrations. Its most important service outcome is that appointments can continue during a system outage, even if the portal is temporarily unavailable.

A first strategy conversation might produce the following record:

Lesson table; scroll horizontally to read all columns →

This is deliberately incomplete. The four-hour target is a working assumption until the operations director validates it. The dependency map may change the priority. The exercise may reveal that the manual process is more important than the technical restore. A strategy is allowed to change when evidence improves; the change should be recorded so that people understand why the decision moved.

1.7 The one-page strategy test

Before buying or building anything, try to write six sentences:

1. We must keep this service available or recoverable for these people.
2. The service owner accepts this impact limit.
3. Our leading evidence-backed scenarios are these.
4. This quarter we will deliver these measurable outcomes.
5. These owners will make the tradeoff decisions and perform the work.
6. We will review these signals on this cadence and revise the plan when evidence changes.

If any sentence is impossible to complete, the missing fact is the next research task. The purpose of the one-page test is not to hide complexity. It forces the team to show the relationship between mission, risk, action, and evidence before it expands into a long plan.

Chapter 1 exercises

These five exercises are the first of the required minimum of fifty. Their worked results appear at the end of this draft. Use only the fictional Northstar Community Services case above.

EX001 — Activity or outcome

Classify each statement as an activity or a measurable service outcome, then rewrite one activity as an outcome: (a) buy an endpoint security tool; (b) restore appointment scheduling from backup within four hours in a timed exercise; (c) write a phishing policy; (d) send an alert to an assigned reviewer within fifteen minutes of a privileged account change.

EX002 — Scenario construction

Write a four-part risk scenario for the volunteer roster using condition, service, consequence, and evidence gap. State one assumption that needs confirmation. Do not claim that any breach has occurred.

EX003 — Evidence selection

Northstar reports that “all critical services have backups.” Name three pieces of evidence that would test whether this supports its appointment continuity goal. Explain why a configuration screenshot alone is insufficient.

EX004 — Priority decision

The team has one week. It can either (a) purchase a dashboard with no assigned alert owner or (b) run a timed restoration exercise with the operations director. Choose the first action and give two reasons. State one condition under which the other action might become appropriate later.

EX005 — One-page strategy

Complete the six-sentence strategy test for Northstar. Mark at least two statements as assumptions or pending owner approval. Include one outcome with an owner, date, and evidence.

Concepts — three questions a number cannot answer

Coverage, quality and effect are different jobs. Coverage counts whether a population sits inside the set being managed. Quality asks whether a control survived a deliberate test. Effect asks whether the service result moved for the people who depend on it. A single decimal cannot take all three jobs, and it cannot sit in Govern, because Govern names expectations, responsibilities and a direction for risk.

Lesson table; scroll horizontally to read all columns →

Data — where the six sentences stop

Lesson table; scroll horizontally to read all columns →

Decision flow — reject the number, then test the blank sentence

flowchart TD
  A["A vendor figure or a platform offer"] --> B{"Can anyone name the choice that flips at that figure?"}
  B -->|No| C["Reject the figure as false precision"]
  B -->|Yes| D{"Is sentence 2 complete?"}
  C --> D
  D -->|No| E["The blank sentence is the next research task"]
  E --> F["Do not treat the purchase as the strategy choice"]
  D -->|Yes| G{"Which job does the action do?"}
  G -->|Population counted| H["Coverage"]
  G -->|Control survived a test| I["Quality"]
  G -->|Service result moved| J["Effect"]
  I --> K["A timed restore can speak to quality and, once the clock is kept, to effect"]
  H --> L["Coverage does not answer the four-hour outcome"]

Worked example — Calder's Tuesday brochure

The Tuesday brochure from Calder Systems shows a green shield and a readiness figure of 9.1. The engineer keeps that figure out of the decision table, because no colleague can name a choice that would differ if the printed figure moved by a tenth. She drafts the six sentences on the same page. Sentence 1 can name appointment scheduling for clients and front-desk staff, while the portal itself may be down. Sentence 2 stops blank: acceptance by the operations director is still missing, so the unfinished line is the research task, and a catalogue order for the Calder platform is refused. The timed restore stays the first checkable outcome. It can speak to a test and to the service clock only after someone runs it. Integrations with outside firms stay uncounted, which is a separate gap.

Synthetic case. That vendor mark is a classroom illustration, not a measurement Northstar collected from its own portal.

Apply

• EX051 — A decimal on a slide. Calder Systems presents a readiness score of 9.1. Why does the false-precision rule reject it, and which two measure types can a timed restore speak to?
  Show marking criteria

  Rubric: 3 = nobody can say what decision changes at 9.1; a timed restore can show quality and, if the clock is kept, effect; coverage is a different question;; 2 = rejects the score;; 1 = accepts 9.1;; 0 = none.
• EX052 — The blank second sentence. Sentence 2 of the one-page test cannot be completed. What fact is missing, and may the team treat a platform purchase as the strategy choice?
  Show marking criteria

  Rubric: 3 = the operations director has not accepted the four-hour limit; the missing fact is the next research task; a blank sentence blocks the purchase;; 2 = the limit is unaccepted;; 1 = buy the platform;; 0 = none.

Sources for this chapter

• NIST Cybersecurity Framework 2.0 — framework functions and risk-management purpose.
• NIST CSF 2.0 Small Business Quick Start — starting a modest program in organizational context.
• NIST Privacy Framework — privacy risk beyond security events.
• U.S. GAO, Critical Infrastructure Protection: TSA Is Taking Steps to Address Some Pipeline Security Program Weaknesses — public facts about the 2021 Colonial Pipeline incident.

All case details for Northstar Community Services are fictional. The strategic lesson drawn from the GAO report is explicitly identified as an inference.