Chapter 10 — Security governance, risk and compliance: orientation

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Three parts"]
  N2["10.2 Obligations"]
  N3["10.3 Roles"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Three parts"]
  N2["10.2 Obligations"]
  N3["10.3 Roles"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Three parts]
    |
    v
[10.2 Obligations]
    |
    v
[10.3 Roles]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) explain governance, risk management and compliance in a clinic group; (2) identify Riverton's obligations; (3) describe the roles involved.

10.1 Three parts

Priya begins the GRC courses. Governance means Riverton's leaders set direction and check progress: they decide what risks are acceptable and who is responsible. Risk management means finding, assessing and treating risks in a structured way, following principles such as those in ISO 31000:2018. Compliance means meeting obligations from health data law, card payment rules and contracts. She learns that the three parts must work together for security to be managed rather than improvised. At Riverton, for example, the managing director deciding acceptable risk is governance, while checking PCI DSS obligations is compliance.

10.2 Obligations

Priya lists Riverton's obligations: data protection law covering patient records, health sector confidentiality rules, PCI DSS v4.0 for card payments through its bank, and contracts with the practice system provider and dental laboratories. She separates legal duties from contractual ones and from voluntary standards Riverton may adopt, such as aligning with NIST CSF 2.0. She learns that knowing where an obligation comes from helps determine its priority and who must be involved. Mr. Lind adds that the laboratory contracts belong in this list too, since two laboratories later turn out to have no written agreement.

10.3 Roles

Riverton's managing director is accountable for risk. An operations manager coordinates security with a small IT team and an external support provider. Clinic managers own local controls, such as access for their staff. A data protection officer advises on patient data. Priya draws a simple chart of these roles and notes that the external provider's responsibilities are not written down anywhere. She recommends clarifying them in the contract. Unwritten provider duties mean, for example, that nobody can say whether the support provider must patch clinic routers.

Worked example

Priya explains the three GRC parts, lists Riverton's obligations by source and finds the support provider's responsibilities undocumented.

Synthetic case. Riverton's structure is synthetic; ISO 31000:2018, PCI DSS v4.0 and CSF 2.0 are real.

Errors and limits

Legal obligations need professional advice. Roles change with growth.

Exercises

• EX028 — Compliance meaning. What does compliance mean for Riverton?
  Show marking criteria

  Rubric: 3 = meeting obligations from law, card rules and contracts;; 2 = obligations;; 1 = vague;; 0 = none.
• EX029 — Obligation source. Why does the source of an obligation matter?
  Show marking criteria

  Rubric: 3 = it determines priority and who is involved;; 2 = priority;; 1 = vague;; 0 = none.
• EX030 — Undocumented role. Whose responsibilities were not written down?
  Show marking criteria

  Rubric: 3 = the external support provider's;; 2 = provider;; 1 = vague;; 0 = none.

Synthesis

GRC orientation connects direction, risk management and obligations through clear roles.

Continue studying — chapter 10 of 30

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →