Page 363 - CyberSecurityEssentialsEnglish

TABLE 8-2: PRACTICAL DIFFERENCES AMONG GOVERNANCE CONCEPTS

Concept What it answers Typical output

Who decides, and what risk will Direction, mandate, and risk
Governance
we accept? appetite.

How do we deliver this in
Management Processes, roles, and resources.
practice?

Risk What could go wrong, and what
A risk register and controls.
management do we do about it?

Are we meeting the rules that Evidence of adherence and
Compliance
bind us? reporting.

How confident can others Testing, evaluation, and evidence
Assurance
reasonably be? packs.

Is the system working as we An independent assessment and
Internal audit
claim? findings.

Is this acceptable even where it is A judgment about fairness and
Ethics
permitted? effect on people.

FIGURE 8-2: HOW THE SIX FUNCTIONS DEPEND ON ONE ANOTHER

What to notice: Table 8-2 defines each function. This figure shows the order they run in, and
that an audit finding changes nothing until it reaches the body that sets the mandate.
Source: Prepared by the author.

362