Chapter 11 — Security governance, risk and compliance: assets and context
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Context"]
N2["11.2 Classification"]
N3["11.3 Risk criteria"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Context"]
N2["11.2 Classification"]
N3["11.3 Risk criteria"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 Context]
|
v
[11.2 Classification]
|
v
[11.3 Risk criteria]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) set the context for risk assessment; (2) classify information assets; (3) define risk criteria with management.
11.1 Context
Before assessing risks, Priya documents Riverton's context: its services, patients, regulators, suppliers, growth plans and attitude to risk. ISO 31000:2018 begins its process with establishing scope, context and criteria. The managing director explains that Riverton plans to open three new clinics next year and that reputation with patients is its greatest asset. These facts shape which risks matter most and how much disruption Riverton can accept. Three new clinics next year means the standard clinic design must be ready before they open.
11.2 Classification
Priya classifies information into three levels: public, such as opening hours; internal, such as staff rotas; and confidential, such as patient records and images. Each level has handling rules for storage, sharing and disposal. Patient records require encryption and secure messaging; internal data stay within Riverton's systems. She learns that simple classifications are more likely to be followed than complex schemes with many levels that staff cannot remember. X-ray images fall under confidential, so they inherit the encryption and secure messaging rules automatically.
11.3 Risk criteria
With management, Priya defines criteria for likelihood and impact. Impact levels describe effects on patients, finances, regulators and reputation. For example, a major impact means clinics closed for more than a day or a reportable data breach affecting many patients. Likelihood levels use frequency ranges. She learns that agreed criteria make assessments consistent across assessors, and that defining them with management ensures they reflect Riverton's real priorities. Defining a major impact as clinics closed for more than a day, for instance, lets two assessors score the same ransomware scenario alike.
Worked example
Priya documents Riverton's context, sets three classification levels and agrees impact and likelihood criteria with management.
Synthetic case. Riverton's context and criteria are synthetic; ISO 31000:2018 is real.
Errors and limits
Criteria involve judgement. Classifications are misapplied.
Exercises
- EX031 — Growth fact. Which planned change affects Riverton's context? Rubric: 3 = three new clinics next year;; 2 = growth;; 1 = vague;; 0 = none.
- EX032 — Classification levels. What are the three classification levels? Rubric: 3 = public, internal, confidential;; 2 = three;; 1 = vague;; 0 = none.
- EX033 — Major impact. Give the example of a major impact. Rubric: 3 = clinics closed over a day or reportable breach affecting many patients;; 2 = major;; 1 = vague;; 0 = none.
Synthesis
Context, classification and agreed criteria make risk assessments consistent and relevant.
Continue studying — chapter 11 of 30
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →