Oct 05: Governance and Risk

Information security policy

Master list of policies for uptime, availability, and security, including roles and responsibilities; the organization must enforce it.

AUP

Acceptable use policy: what users may do with company technology; limits legal liability and documents reasons for dismissal.

Business continuity plan

Policies for operating when normal technology is unavailable (such as manual card processing); planned and tested in advance.

Disaster recovery plan

Continuity plan for widespread or extended disasters; needs a recovery site, data recovery, application restoration, and available staff.

Incident response roles

Incident response team, IT security management, compliance officers, technical staff, and users who report what they saw.

SDLC: Waterfall vs Agile

Software development lifecycle moves from idea to deployed app. Waterfall: linear stages from requirements to maintenance. Agile: fast, repeating cycles of design, develop, test, deploy, and review.

Security standards sources

ISO and NIST publish ready-made security standards.

Security standards topics

Passwords (complexity, central authentication, resets, change frequency, storage), access control (who, when, and how access is removed), physical security (badges, locks, escorts), and encryption (algorithms, hashed or salted passwords, different rules per data state).

Change management steps

Determine scope, assess risk, make a plan, get approval, change control board approves and schedules, have a backout plan, document the change.

Onboarding

New hire or transfer: handbook and AUP sign-off, accounts, rights and permissions, equipment.

Offboarding

Handle hardware and data; disable (do not delete) the account so decryption keys and data are not lost.

Playbook and SOAR

Playbook: step-by-step response for a specific event (data breach, ransomware). SOAR (Security, Orchestration, Automation, and Response) integrates tools and automates playbook tasks.

Governance structure

Board sets broad objectives; committees of subject matter experts plan how; the board approves. Public sector meetings are open to the public.

Centralized vs decentralized governance

Centralized: one group makes decisions for the whole organization. Decentralized: decisions are made by those doing the work.

SOX

Sarbanes-Oxley Act: protects financial data and who can access it at public companies.

HIPAA

Protects health information in storage, in transfer, and when disclosed to third parties.

Legal hold

IT must preserve data so it is available for future legal proceedings.

Breach disclosure laws

Breaches must be disclosed within an appropriate time frame; rules vary by region.

Data sovereignty

Some countries require data collected from their citizens to stay within their borders, which affects cloud storage.

Industry and scope considerations

Utilities are often air-gapped; medical environments use heavy encryption but stay accessible. Local, national, and global organizations face different legal needs.

Data owner

Senior person broadly and ultimately responsible for a data set (the VP of sales owns customer data, the treasurer owns financial data).

Data controller vs processor

Controller manages how data is used and instructs the processor. Processor actually uses the data. Example: payroll department is the controller, payroll company is the processor.

Data custodian / steward

Responsible for data security, accuracy, and privacy; ensures compliance and assigns sensitivity labels tied to access control.

Risk assessment types

One-time (tied to a project), ad hoc (one specific purpose), recurring (on a schedule, sometimes mandated like PCI DSS), and continuous (every change in change control).

Qualitative risk assessment

Rates each risk factor as low, medium, or high, such as a traffic light grid.

AV (asset value)

Worth of the asset to the organization, including sales impact and fines, not just replacement cost.

EF (exposure factor)

Percent of value lost: 0.25 for a quarter, 1.0 for the whole asset.

ARO

Annualized rate of occurrence: how often the risk happens in one year.

SLE and ALE

SLE = AV x EF. ALE = SLE x ARO. Example: stolen laptop, AV $1,000 x EF 1.0 = SLE $1,000; 7 stolen per year gives ALE $7,000.

Likelihood vs probability

Likelihood is qualitative (rare, possible, almost certain). Probability is quantitative (a statistic).

Risk impact categories

Life (top priority), property, safety, finance.

Risk appetite vs risk tolerance

Appetite: the amount of risk an organization is willing to take (conservative, neutral, or expansionary posture). Tolerance: a wider variance just above appetite, like the speed limit vs the speed at which you actually get ticketed.

Risk register

Lists each risk with its key risk indicator, an owner, and a risk threshold.

Risk threshold

Balance between what it costs to resolve a risk and what the risk would cost the company.

Risk transference

Move the risk under the control of another party, such as buying cybersecurity insurance.

Risk acceptance

Acknowledge the risk and carry on; often done by granting an exemption or an exception to policy.

Exemption vs exception

Exemption: a system is excused from a policy it cannot follow (such as unpatchable equipment kept off the network). Exception: a deviation allowed when the policy could be followed but is impractical (such as patching later than the required window).

Risk avoidance

Remove the risk completely by stopping the activity that creates it.

Risk mitigation

Reduce likelihood or impact with controls, such as a next-generation firewall for internet risk.

Risk reporting

Constantly updated list of critical and emerging risks that upper management uses for business decisions.

RTO

Recovery time objective: how long until the organization is up and running again, such as both the database and web server being operational.

RPO

Recovery point objective: the point in time or amount of data that must be restored before operations count as up and running.

MTTR

Mean time to repair: time to diagnose, get replacement equipment, install, and configure; reduced by on-site spares or a fast replacement contract.

MTBF

Mean time between failures: total uptime divided by the number of breakdowns.

Penetration testing and rules of engagement

Actively exploits vulnerabilities. Rules of engagement set scope, in-scope and out-of-scope devices, IP ranges, timing, emergency contacts, and handling of sensitive data.

Right to audit

Contract clause for regular audits of a vendor, often by an independent third party; covers access management, offboarding, passwords, and VPN controls.

Supply chain analysis

Examine security from raw materials or vendors through to the customer. Example: the SolarWinds signed update that delivered malware to customers.

Independent assessment

An outside party gives a perspective and insights from many organizations.

Due diligence

Investigating and verifying a company (claims, background checks, interviews) before doing business with it.

Conflict of interest

Anything that could compromise judgment, such as a vendor also working with your biggest competitor, employing an executive's relative, or offering gifts.

Vendor monitoring and questionnaires

Ongoing financial health checks, IT security reviews, and news monitoring. Questionnaires ask about due diligence, disaster recovery, and data storage protections.

SLA

Service-level agreement: minimum service terms such as maximum unscheduled downtime (for example 4 hours), technician dispatch, and on-site spare equipment.

MOU vs MOA

MOU: informal, broad goals, not a signed contract, may include confidentiality. MOA: one step above with more detail; may have binding parts but is generally not an enforceable contract.

MSA

Master service agreement: a legal contract setting ongoing terms (services, billing) as a framework for future work.

SOW

Statement of work (or work order): scope, location, deliverables schedule, and expectations for one job; used under an MSA.

NDA

Non-disclosure agreement: a signed formal contract keeping shared business information confidential; can be unilateral, bilateral (mutual), or multilateral.

BPA

Business partners agreement: financial details, ownership stake, who makes business decisions, and what happens if things go wron