Chapter 9 — Security governance, risk and compliance: tools and methods
Lesson map
Lesson 09 published. Map, example, EX033.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Risk method"]
N2["9.2 Checklists"]
N3["9.3 Choosing tools"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX033"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Risk method"]
N2["9.2 Checklists"]
N3["9.3 Choosing tools"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX033"]
[Learning outcomes]
|
v
[9.1 Risk method]
|
v
[9.2 Checklists]
|
v
[9.3 Choosing tools]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX033]
Learning outcomes
You will (1) use a simple risk method; (2) apply a control checklist; (3) choose tools suited to a small team.
9.1 Risk method
Fenwick uses a simple method: list risks, rate likelihood and impact from one to five, multiply for a score and treat the highest first. Amina helps rate risks for the online shop. She learns the method is quick but has limits: very different risks can get the same score, and a rare but severe event can look low. She notes these limits and suggests discussing the top risks in more detail rather than relying only on scores. A one-in-twenty chance of a payment gateway breach, for example, may score lower than frequent shop slowdowns despite a far worse impact.
9.2 Checklists
Amina uses a control checklist based on the NIST CSF 2.0 small business resources to review Fenwick's basics: inventory, accounts, updates, backups, logging and incident response. Each item is marked in place, partly in place or missing, with evidence. The checklist reveals that incident response is missing a written plan. She learns that checklists help small teams cover essentials without needing deep expertise in every area. The missing incident response plan becomes a register entry with an owner rather than a note on the checklist.
9.3 Choosing tools
Fenwick's small IT team cannot run complex governance software. Amina recommends using tools they already have: the ticketing system for tasks, spreadsheets with validation for the register and short scripts for checks. She learns that the best tool is one the team will actually use and maintain, and that adding software without people to run it often increases risk rather than reducing it. Ms. Bell observes that a spreadsheet with validation, kept current by three technicians, gives Fenwick more than an unused governance platform.
Worked example
Amina rates shop risks with a simple method, reviews basics with a CSF-based checklist and recommends existing tools.
Synthetic case. Ratings and checklist results are synthetic; CSF 2.0 resources are real.
Errors and limits
Scores hide severity. Checklists miss context.
Exercises
- EX033 — Method limit. What is one limit of the multiply-scores method? Rubric: 3 = rare severe events can look low;; 2 = severity;; 1 = vague;; 0 = none.
- EX034 — Missing item. What did the checklist reveal as missing? Rubric: 3 = a written incident response plan;; 2 = incident plan;; 1 = vague;; 0 = none.
- EX035 — Tool choice. What tools did Amina recommend? Rubric: 3 = ticketing, validated spreadsheets and short scripts;; 2 = existing tools;; 1 = vague;; 0 = none.
- EX036 — Checklist ratings. How is each checklist item marked? Rubric: 3 = in place, partly in place or missing, with evidence;; 2 = three states;; 1 = vague;; 0 = none.
Synthesis
Simple methods, checklists and familiar tools suit small technical teams.
Continue studying — chapter 09 of 18
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →