Skip to content
academia.sh
tr
Log in

Course Advanced

Governance, Risk and Compliance

Published Updated

By the end of this course

Start course

01

Risk Management

Ranking the defenses measured one by one by nine courses on the same list: producing a risk list from asset, threat and impact items, how qualitative scoring and monetary modeling rank the same list differently, the risk reduced per unit by mitigation, transfer, acceptance and avoidance in the same budget, the item missing from the inventory that can enter no ranking, and the control delegated to a supplier but not verifiable.

  1. 01 Risk Assessment Process The course's unit of measure is established: 70 pairs of ten assets and seven threats produce 47 risk items, a total annual risk of 5,768.61 fictional units is distributed across the asset classes, the 300-count class holds a 7.2 percent share while the three-count class reaches 17.9 percent, and ranking by decrease per unit of effort changes the position of 45 items in the same list and reduces 240.00 more units of risk on a 200-unit budget.
  2. 02 Qualitative and Quantitative Approaches The same 47 items are run through two scales: the monetary model computes single and annualized loss expectancy in fictional units, while the five-by-five qualitative matrix reduces the items to three levels, ties 479 of the 1,081 item pairs and reverses 52 of them, writes the 184.80-unit item as medium and the 96.00-unit item as high, and opens a 745.20-unit gap in the outcome of the same ten items chosen with the same effort.
  3. 03 Risk Treatment Options Mitigation, transfer, acceptance and avoidance are all run under the same annual budget of 300 units: mitigation reduces risk by 2,746.71 units with 22 decisions while transfer and avoidance stay at 243.00 and 656.04 units, the transfer agreement takes over 76 of 235 component items and leaves 3,507.70 units outside, avoidance is an asset-level decision so it can never enter the ranking even under a 1,200-unit budget, and 1,699.81 of the 3,021.90 accepted units come from 25 items that were never opened.
  4. 04 Asset and Inventory Management When six off-inventory assets are added to the list, the 47-item list grows to 69 items and the 5,768.61-unit total rises to 8,045.45 fictional units: off-inventory items carry 28.3 percent of the true risk, 41 recorded items change rank, the largest shift is 22 positions, six shadow items enter the top twenty, 8 of the 30 shadow items can never enter any ranking because their value was never written, and the shadow item that rises to the highest rank comes from an asset no discovery source has ever seen.
  5. 05 Third-Party Risk Across three suppliers, 3 of the 16 controls written into the contract are never asked about in the survey, 6 are answered but not verified, and only 7 are verified by evidence: the 9 controls that appear delegated but cannot be verified carry 555.10 fictional units, 25.4 percent of supplier risk; when the 62-item program list is ranked by evidence instead of declaration, 51 items change position and the number of supplier items in the top ten rises from one to three.

02

Frameworks

Translating an organization's own measurement into an externally readable common language, and the cost of that language in terms of evidence production: the maturity calculation of a function-based framework, the certifiable management system cycle and the items a narrowed scope leaves out, the requirements left without evidence and the controls that satisfy more than one requirement in a control-to-requirement matrix, the extra controls brought in by sector-specific requirements tied to data type, the per-system search cost of data subject rights, which level counts as evidence in an audit within the policy/standard/procedure hierarchy, and the findings that independent assurance's separation of interests brings to light.

  1. 01 Security Frameworks The structure of a function-based framework and a maturity calculation on a fictional control set: an overall maturity of 1.35 across 5 functions, 14 categories, and 31 control items; 5 controls sitting at level 0 and one category with no working control at all; 15 of 31 controls producing evidence for 25 evidence items; a 45 person-day budget where gap priority and yield priority rank all five functions differently; and a yield-first order that raises the average by 0.07 while leaving the weakest function 0.33 behind.
  2. 02 Management System Standards Running the certifiable management system model through its scope statement, statement of applicability, internal audit, and external certification cycle: in a 23-item inventory, a narrow scope leaves 25 of 100 control items unapplied, keeps 76 percent of total risk out of the certificate, and turns 15 items into an external party; a correction capacity of 20 nonconformities per round blocks certification at broad scope; and the absolute-cost order comes out the exact reverse of the cost-per-unit-of-risk order.
  3. 03 Audit Control Sets Running the matrix between control and requirement: in 28 controls, 25 requirements, and 33 links, only 19 requirements carry operating evidence, 2 are mapped to no control at all, 2 are mapped but produce no evidence, and 2 rest on provider attestation only; 13 requirements stand on a single operating control; 12.3 percent of the 3,205 evidence items produced in the period are reviewed; and the control-count and evidence-load rankings share only three common members in their top five.
  4. 04 Sector-Specific Compliance Requirements Tying compliance requirements to the data type, and the control-side counterpart of narrowing the scope: in 16 systems and 4 data types, the extra controls per type add up to 29 when summed separately and to 20 in the union; 9 multi-type systems carry a control load of 129; removing a type from every system drops 4 and 3 controls respectively, while removing it partially drops no controls at all; residual controls come back; and three separate measures order the same four actions in three different sequences.
  5. 05 Personal Data Protection Counting data subject rights and processing principles as items: because 3 of 15 systems are not in the inventory, 6 of 7 right-request types are answered incompletely, and 28 percent of the 121 monthly requests get caught on shadow systems; a request takes between 55 and 240 minutes, and the monthly workload of 381 person-hours exceeds the 260-person-hour capacity; completing the inventory raises the load to 494.8 person-hours, data minimization lowers it to 324.9, and all 7 processing principles depend on the completeness of the inventory.
  6. 06 Policy, Standard, and Procedure Separating the document hierarchy along the axis of evidence production: only 10 of 26 documents produce evidence in an audit and 9 do not carry a measurable threshold, 9 of 15 requirement chains are complete and 11 are provable, two policy-less chains remain provable thanks to a record-producing procedure, completing the missing links gains evidence for 104 person-days while 14 person-days only fix the appearance, and the rankings by document count and by evidence production diverge.
  7. 07 The Function of Auditor and Compliance Roles Measuring independent assurance in terms of separation of duties: of the 17 real findings in 24 controls, only 3 are visible under self-review, and 12 of the 14 invisible findings stay hidden because of independence; the compliance function sees 8, independent internal audit 17, and sampled external audit 9 findings; full separation surfaces 14 findings while bringing 72 audit-days, 19.2 extra work-days, and 48 extra evidence items; and the rankings by findings seen and by days per finding swap places at the two ends.

03

Program Management

Five lessons that measure every day between the annual snapshots: the gap between the incoming finding stream and remediation capacity in a vulnerability management program and the growth of the queue, the point where the exploited vulnerability and the unplanned outage intersect as the patch window narrows, the decay of awareness training gains by group and the retraining week, the gap between the exercise item that failed to hold and the target time versus the measured time, and finally the separation between the metric that changes behavior and the metric that only reaches the report.

  1. 01 Vulnerability Management Program Against 884 findings arriving over 52 weeks, a weekly remediation capacity of 84 person-hours: a 13.2-hour gap leaves a 684-hour queue by year's end, four prioritization rules close between 709 and 843 items on the same set, and risk exposure ranges from 6,681 to 18,511 point-weeks. The rule's value depends on capacity: the queue empties at 101 hours/week, and the rules' order reverses at 109 hours/week.
  2. 02 Patch and Change Management In a set of forty announcements, the window length is run as a decision variable: as the window shortens, the caught open findings rise from 23 to 30, but unplanned outages climb from 9 to 50; the two curves cross at day nine, and when the outage cost is raised from 900 to 14,000 risk units, the best window shifts from 1 day to 17 days. The approval gate shortens the window by lowering the error multiplier; the two-path regime cuts the single window's total from 207,637 to 130,159 risk units, and a twelve-announcement misclassification error gives back nine-tenths of that gain.
  3. 03 Security Awareness Training Retention is measured separately for five groups: the return week ranges from 5 to 29, and at a thirteen-week retraining interval the same data produces three different rankings by items, risk units and gain per hour, with all five groups changing place. The same 1,512-hour budget yields 51,066 risk units when distributed to everyone as a single interval and 64,391 when distributed group by group; the most populous group gets no training at all under the first two budgets.
  4. 04 Business Continuity and Disaster Recovery Twelve recovery items are run through both the plan and the drill: the plan's critical path stays under the declared 300-minute target at 260 minutes, the drill measures 421 minutes and overshoots the target by 121 minutes, and only 161 of the drill report's 293 minutes of delay are reflected in recovery time. When a six-person-day budget is spent by report-delay order the gain is zero; spent by critical-path-gain order it is 40 minutes. The cost of dropping below the target ranges from 32 to 21 person-days depending on the ranking measure.
  5. 05 Security Metrics Eighteen program metrics split into four groups: eight carry decisions and take 48 percent of the annual collection cost, two exceed their threshold but drop the signal because they have no defined action, five approach the threshold and never cross it, and three never engage their threshold at all. The most expensive metric costs 192 hours a year and produces zero decisions; six of the eight decision-bearing metrics swap places between the decision-count ranking and the hours-per-decision ranking.

Final exam

Governance, Risk and Compliance — Final Exam

In preparation

This course's question bank is not complete yet. The exam opens here automatically once enough questions are added.

Start typing to search.

↑↓ ↵ Esc navigate · open · close