Chapter 6 — Security governance, risk and compliance: system model

Lesson map

Lesson 06 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 GRC and technicians"]
  N2["6.2 Fenwick's roles"]
  N3["6.3 Connecting tasks"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 GRC and technicians"]
  N2["6.2 Fenwick's roles"]
  N3["6.3 Connecting tasks"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX021"]

[Learning outcomes]
    |
    v
[6.1 GRC and technicians]
    |
    v
[6.2 Fenwick's roles]
    |
    v
[6.3 Connecting tasks]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) explain how GRC fits with technical work; (2) model Fenwick's governance roles; (3) connect technical tasks to policies and risks.

6.1 GRC and technicians

Amina learns that governance sets rules and priorities, risk management decides what matters most and compliance checks obligations are met. Technicians make these work: they configure systems, collect evidence and fix problems. Ms. Bell explains that understanding GRC helps technicians see why tasks matter. A baseline check is not busywork; it supports a policy, reduces a risk and produces evidence an assessor may ask for. Ms. Bell gives an example: the encryption baseline check reduces the lost laptop risk and answers a question the card payment assessor may ask.

6.2 Fenwick's roles

Fenwick's finance director is accountable for security. An IT lead manages a team of three technicians. Branch managers own local tasks such as confirming staff leavers. An external assessor checks card payment compliance each year. Amina draws these roles and the flow of information between them, noting that technicians report issues to the IT lead, who reports risks to the finance director. The drawing also shows that the external assessor depends on evidence that technicians produce, such as firewall rule lists.

6.3 Connecting tasks

Amina builds a table linking technical tasks to policies, risks and obligations. Laptop encryption links to the data protection policy and the lost device risk. Firewall rule reviews link to the network policy and card payment obligations. Log reviews link to the monitoring policy and account misuse risk. She learns that this table helps technicians prioritise when time is short and explains to managers why technical work deserves resources. When time is short, for instance, the firewall review ranks above a log review because it also carries card payment obligations.

Worked example

Amina explains GRC's link to technical work, models Fenwick's roles and maps technical tasks to policies, risks and obligations.

Synthetic case. Fenwick's roles are synthetic.

Errors and limits

Tables simplify complex links. Roles change.

Exercises

• EX021 — Baseline purpose. Why is a baseline check not busywork?
  Show marking criteria

  Rubric: 3 = it supports a policy, reduces a risk and produces evidence;; 2 = purpose;; 1 = vague;; 0 = none.
• EX022 — Accountable person. Who is accountable for security at Fenwick?
  Show marking criteria

  Rubric: 3 = the finance director;; 2 = finance director, hedged with another option;; 1 = IT lead;; 0 = none.
• EX023 — Firewall links. Which policy and obligation do firewall reviews support?
  Show marking criteria

  Rubric: 3 = network policy and card payment obligations;; 2 = links;; 1 = vague;; 0 = none.
• EX024 — Table use. How does the task table help technicians?
  Show marking criteria

  Rubric: 3 = prioritise when time is short;; 2 = priorities;; 1 = vague;; 0 = none.

Synthesis

Linking technical tasks to policies, risks and obligations shows why they matter.

Continue studying — chapter 06 of 18

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →