Chapter 23 — Security governance, risk and compliance: evaluation | Technologist Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 23 — Security governance, risk and compliance: evaluation

Lesson map

Lesson 23 published. Map, example, EX067.

flowchart TD
  N0["Learning outcomes"]
  N1["23.1 Evaluation questions"]
  N2["23.2 Findings"]
  N3["23.3 Recommendations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX067"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["23.1 Evaluation questions"]
  N2["23.2 Findings"]
  N3["23.3 Recommendations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX067"]

[Learning outcomes]
    |
    v
[23.1 Evaluation questions]
    |
    v
[23.2 Findings]
    |
    v
[23.3 Recommendations]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX067]

Learning outcomes

You will (1) evaluate the GRC programme's first year; (2) use evidence to judge progress; (3) recommend improvements.

23.1 Evaluation questions

After a year, Priya helps evaluate Riverton's programme. She asks: are top risks lower? Are controls operating? Is evidence fresh? Are owners engaged? She gathers data from the register, test results, indicator trends, evidence log and a short survey of clinic managers. She learns that evaluation should use several sources, since any single measure can be misleading, and that questions should be set before looking at the data. Setting questions in advance keeps the evaluation from highlighting only the measures that improved.

23.2 Findings

Ransomware risk is lower: segmentation is complete in twelve of fourteen clinics and backups are tested monthly. Card skimming risk fell sharply after moving to a hosted payment page. Control tests pass more often than in the pilot. Evidence freshness improved, though supplier reports still lag. Clinic managers say tasks are clearer but the access review remains time-consuming. Priya presents findings with the evidence for each. Supplier reports lagging repeats the freshness problem found in chapter 9, so the cause lies with contracts, not with the clinics.

23.3 Recommendations

Priya recommends finishing segmentation in the last two clinics, automating access review lists, adding supplier report requests to contract renewals and simplifying the clinic manager checklist. She also recommends preparing for ISO/IEC 27001:2022 certification next year. She learns that evaluations are useful when they lead to specific improvements and that recognising progress motivates staff to continue the work. Each recommendation answers a specific finding, such as the access review still being time-consuming. Specific recommendations can also be tracked as actions with owners in the ticketing system.

Worked example

Priya evaluates the programme with five sources, finds reduced ransomware and card risk and recommends four improvements.

Synthetic case. Evaluation data are synthetic; ISO/IEC 27001:2022 is real.

Errors and limits

One year is short. Survey responses may be polite.

Exercises

EX067 — Evaluation sources. Which sources did the evaluation use? Rubric: 3 = register, test results, indicators, evidence log and survey;; 2 = five;; 1 = vague;; 0 = none.
EX068 — Segmentation progress. How many clinics completed segmentation? Rubric: 3 = twelve of fourteen;; 2 = 12/14;; 1 = vague;; 0 = none.
EX069 — Remaining burden. Which task remained time-consuming? Rubric: 3 = the access review;; 2 = access review, hedged with another option;; 1 = vague;; 0 = none.

Synthesis

Multi-source evaluation shows progress and points to specific improvements.

Continue studying — chapter 23 of 30

← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →