OpenCyber AcademyLearning outcomes
You will (1) describe the systems a multi-site business relies on; (2) list assets that governance must cover; (3) link systems to the services they support.
1.1 Riverton's systems
Priya Natarajan is a technologist student at the fictional Halden Institute of Technology. Her tutor, Mr. Oskar Lind, uses one running case: the fictional Riverton Dental Group, with fourteen clinics and two hundred and fifty staff. Each clinic has reception computers, dental imaging devices and a card terminal. A cloud practice management system holds patient records and appointments. A booking website lets patients schedule visits. Priya learns that governance starts by knowing which systems exist and what each one does. With fourteen clinics, even a single unlisted device type repeated in every clinic would leave fourteen gaps at once.
1.2 Assets to cover
Priya lists assets by type: hardware such as reception computers and imaging devices, software such as the practice management system, data such as patient records and X-ray images, and services such as email and the booking site. For each she notes an owner and the clinics that use it. She finds that imaging devices are missing from IT's list because dentists bought them directly from suppliers. She learns that purchases outside IT create blind spots in governance. Mr. Lind asks who patches the imaging devices, and nobody at Riverton can answer, which shows why ownership must be recorded at purchase.
1.3 Systems and services
Priya links each system to the patient services it supports. Booking depends on the website and practice system. Treatment depends on imaging and patient records. Billing depends on card terminals and the practice system. This map shows which failures would stop clinics from treating patients, which matters most to Riverton. She learns that governance priorities should follow services that matter to customers and the business, not simply the most expensive or technically complex systems. The practice system, for instance, appears under booking, treatment and billing, so its failure would stop all three services.
Worked example
Priya lists Riverton's systems and assets, finds imaging devices missing from IT records and maps systems to patient services.
Synthetic case. Halden, Riverton and all details are synthetic.
Errors and limits
Asset lists miss devices bought locally. Service maps simplify dependencies.
Exercises
- EX001 — Blind spot. Why were imaging devices missing from IT's list?
Show marking criteria
Rubric: 3 = dentists bought them directly from suppliers;; 2 = local purchase;; 1 = vague;; 0 = none. - EX002 — Asset types. Name the four asset types Priya used.
Show marking criteria
Rubric: 3 = hardware, software, data and services;; 2 = four;; 1 = vague;; 0 = none. - EX003 — Treatment dependency. Which systems does treatment depend on?
Show marking criteria
Rubric: 3 = imaging and patient records;; 2 = imaging;; 1 = vague;; 0 = none.
Synthesis
Knowing systems, assets and the services they support is where governance begins.