Chapter 15 — Security governance, risk and compliance: guided lab

Chapter 15 — Security governance, risk and compliance: guided lab

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 Workshop"]
  N2["15.2 Register"]
  N3["15.3 Owners and dates"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 Workshop"]
  N2["15.2 Register"]
  N3["15.3 Owners and dates"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 Workshop]
    |
    v
[15.2 Register]
    |
    v
[15.3 Owners and dates]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) carry out a guided risk assessment workshop; (2) record results in a register; (3) agree treatment owners.

15.1 Workshop

Priya runs a guided workshop with the operations manager, two clinic managers, the IT lead and the data protection officer. They review the four scenarios, the expected loss estimates and the criteria. Each participant gives views on likelihood and impact before discussion, to avoid the first speaker anchoring everyone else. Differences are discussed and the group agrees ratings, recording any strong disagreement in the notes. Collecting views before discussion matters here because the IT lead and clinic managers may see ransomware's likelihood very differently.

15.2 Register

Priya records results in Riverton's risk register: scenario, owner, current controls, ratings, expected loss range and proposed treatment. For ransomware, treatment includes completing network segmentation and testing offline backups. For misdirected records, it includes secure messaging and staff guidance. She learns that a register entry should be complete enough that someone who missed the workshop understands the risk and what will be done. The ransomware entry, for instance, should name segmentation and offline backup testing so a reader knows exactly what changes.

15.3 Owners and dates

Each treatment receives an owner and a target date agreed in the workshop. The IT lead owns segmentation, due in four months; clinic managers own secure messaging adoption, due in two months. Priya schedules a follow-up review. She learns that treatments without owners and dates rarely happen, and that agreeing them in the room, rather than assigning them afterwards, increases commitment. Mr. Lind suggests checking the two-month secure messaging target first at the follow-up, since it falls due before segmentation.

Worked example

Priya runs a workshop with independent first views, records four risks in the register and agrees owners and dates for treatments.

Synthetic case. The workshop is synthetic.

Errors and limits

Workshops reflect who attends. Dates slip.

Exercises

• EX043 — Anchoring defence. How did Priya avoid anchoring in the workshop? Rubric: 3 = each participant gave views before discussion;; 2 = independent views;; 1 = vague;; 0 = none.
• EX044 — Ransomware treatment. What treatments were proposed for ransomware? Rubric: 3 = network segmentation and offline backup testing;; 2 = two;; 1 = vague;; 0 = none.
• EX045 — Commitment. Why agree owners and dates in the room? Rubric: 3 = it increases commitment;; 2 = commitment;; 1 = vague;; 0 = none.

Synthesis

Guided workshops with independent views and agreed owners produce actionable registers.

Continue studying — chapter 15 of 30

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →