Chapter 17 — Security governance, risk and compliance: tooling
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Test results as data"]
N2["17.2 Per-clinic summary"]
N3["Lab — Pass rates per clinic from a CSV file"]
N4["17.3 Patterns"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Test results as data"]
N2["17.2 Per-clinic summary"]
N3["Lab — Pass rates per clinic from a CSV file"]
N4["17.3 Patterns"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 Test results as data]
|
v
[17.2 Per-clinic summary]
|
v
[Lab — Pass rates per clinic from a CSV file]
|
v
[17.3 Patterns]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) use scripts to process control test results; (2) summarise results per site; (3) spot patterns across sites.
17.1 Test results as data
Riverton begins testing three controls in four pilot clinics: backups, screen locks and access reviews. Results are recorded in a shared CSV file with the clinic, the control and pass or fail. Priya writes a script using Python's standard csv module to read the file and summarise results. She learns that simple, consistent data formats make tooling easy, and that a CSV file with clear columns can support useful analysis without expensive software. Twelve rows of clinic, control and result are enough to show which clinic needs help first.
17.2 Per-clinic summary
The lab reads twelve results. South passes all three controls. North and West pass two of three. East passes only one of three. The failures are access review at North, screen lock and access review at East and backup at West. Priya prints the summary for the operations manager and sends each clinic manager their own failures with a note on what each control requires. East, failing two of three, gets attention first, but the next section shows the access review failures share one cause.
Lab — Pass rates per clinic from a CSV file
"""Parse control test results and compute pass rates per clinic (synthetic CSV)."""
import csv, io
data = """clinic,control,result
North,backup,pass
North,screenlock,pass
North,access,fail
East,backup,pass
East,screenlock,fail
East,access,fail
South,backup,pass
South,screenlock,pass
South,access,pass
West,backup,fail
West,screenlock,pass
West,access,pass
"""
rows = list(csv.DictReader(io.StringIO(data))); by = {}
for r in rows: by.setdefault(r["clinic"], []).append(r["result"] == "pass")
for c, v in by.items(): print(f"{c}: {sum(v)}/{len(v)} passed")
fails = [f"{r['clinic']}/{r['control']}" for r in rows if r["result"] == "fail"]
print("failures:", ", ".join(fails))
Run with python3 lab_tests.py. Verified output:
North: 2/3 passed
East: 1/3 passed
South: 3/3 passed
West: 2/3 passed
failures: North/access, East/screenlock, East/access, West/backup
17.3 Patterns
Looking across clinics, Priya sees that access review failed in two of four clinics, more than any other control. She asks why and learns that clinic managers did not receive the account lists in time. This is a process problem, not a local one, so she recommends fixing the central list distribution rather than blaming individual clinics. She learns that tooling is most valuable when it helps find patterns that point to root causes. Fixing list distribution once should improve access review results in every clinic, not just North and East.
Worked example
Priya summarises twelve test results, finds East weakest and South strongest and traces repeated access review failures to late list distribution.
Synthetic case. Test results are synthetic.
Errors and limits
Four clinics are a small pilot. Pass or fail loses detail.
Exercises
- EX049 — Strongest clinic. Which clinic passed all three controls? Rubric: 3 = South;; 2 = South, hedged with East;; 1 = East;; 0 = none.
- EX050 — Failure list. List the four failures. Rubric: 3 = North access, East screenlock, East access, West backup;; 2 = four;; 1 = vague;; 0 = none.
- EX051 — Pattern cause. Why did access review fail in two clinics? Rubric: 3 = managers received account lists late;; 2 = process;; 1 = vague;; 0 = none.
Synthesis
Simple tooling summarises results and reveals cross-site patterns pointing to root causes.
Continue studying — chapter 17 of 30
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →