Chapter 3 — Programming foundations | Technologist Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Programming foundations

Lesson map

Lesson 03 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Reading lists"]
  N2["3.2 Filtering"]
  N3["3.3 Clear output"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Reading lists"]
  N2["3.2 Filtering"]
  N3["3.3 Clear output"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX007"]

[Learning outcomes]
    |
    v
[3.1 Reading lists]
    |
    v
[3.2 Filtering]
    |
    v
[3.3 Clear output]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes

You will (1) write small scripts that read governance lists; (2) count and filter entries; (3) print clear results for managers.

3.1 Reading lists

Priya writes her first Python script to read Riverton's asset list from a CSV file. It counts assets per clinic and lists those without an owner. She learns to use lists, loops and conditions, and to handle a missing value without crashing. Mr. Lind explains that scripts make governance checks repeatable: the same list checked next month will be checked the same way, which manual counting cannot guarantee when staff are busy. When a new clinic is added to the CSV, the script counts it without any change to the code.

3.2 Filtering

Priya filters assets holding patient data that lack an owner, and those whose last update date is more than a year old. The script prints each with its clinic. Two imaging devices and one old reception computer appear. She learns that combining conditions focuses attention on the riskiest gaps. Filtering by sensitivity and age helps managers decide what to fix first, rather than receiving a long list without priorities. An imaging device holding patient images with no owner and no update for a year is exactly what the combined filter is meant to catch.

3.3 Clear output

Mr. Lind reviews Priya's output and asks whether a clinic manager would understand it. She adds headings, the date of the check and a short explanation of each problem. She also sorts results by clinic so each manager sees their own items. She learns that output is part of the control: unclear results get ignored, while clear, sorted results with explanations prompt action from the people responsible. Sorting by clinic means each of the fourteen clinic managers can find their own items in seconds.

Worked example

Priya scripts counts and filters over the asset list and rewrites output sorted by clinic with explanations.

Synthetic case. The asset list is synthetic.

Errors and limits

Scripts depend on accurate input. Old dates may be data errors.

Exercises

EX007 — Repeatability. Why are scripts better than manual counting for repeated checks? Rubric: 3 = the same check runs the same way each time;; 2 = repeatable;; 1 = vague;; 0 = none.
EX008 — Filter conditions. Which two conditions did Priya combine? Rubric: 3 = patient data without owner, or not updated for over a year;; 2 = sensitivity and age;; 1 = vague;; 0 = none.
EX009 — Output change. How did Priya improve the output? Rubric: 3 = headings, date, explanations, sorted by clinic;; 2 = clarity;; 1 = vague;; 0 = none.

Synthesis

Simple scripts with clear output make governance checks repeatable and actionable.

Continue studying — chapter 03 of 30

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →