Reflection Task: Governance and Controls in Your Organisation

Estimated time: 30 to 45 minutes | To complete before Week 3

Part One: Personal Reflection

This week introduced the idea that information security management is a systematic, organisation-wide discipline. Before moving to Week 3, take some time to reflect genuinely on the following questions. There are no right or wrong answers: the goal is to develop your self-awareness as a security-conscious manager.

• Does your organisation have a formal information security policy? If so, when did you last read it, and do the members of your team know it exists and what it requires of them?
• Before this week’s learning, how would you have described the security controls in your team’s working environment? Having now studied the People, Processes and Technology framework and the different types of controls, how has that description changed?
• Is there a gap between the security controls that formally exist in your organisation and the way your team actually behaves day to day? If so, what do you think accounts for that gap? Is it a knowledge gap, a culture issue, a process problem or a resource constraint?
• Thinking about the CIA Triad and the risk management principles from this week, which information assets in your team’s environment do you feel are least well protected? What is the nature of the risk, and what would be the likely impact if that risk materialised?

Part Two: Governance and Controls Audit

Carry out a brief, informal review of the governance and control environment in your team. You do not need to conduct a formal audit or raise concerns with colleagues at this stage: simply observe, ask a few discreet questions and make notes on what you find. Consider the following:

• Who in your team has administrative access to key systems, and is that access necessary and appropriate for their current role? Can you identify anyone who has more access than their role requires?
• Are there any former colleagues, contractors or suppliers who may still have active access to systems or data that your team uses? Is there a clear process for revoking access when someone leaves?
• Does your team have a clear, accessible and well-understood procedure for reporting a security concern, a suspicious email or a suspected incident? If you asked every member of your team what they would do if they received a phishing email tomorrow, would they all give the same answer?
• When your team last adopted a new tool, platform or way of working, was security considered as part of that decision? Who was responsible for assessing the security implications, and was that assessment documented?
• Are there any tools, applications or services that members of your team use that have not been formally approved by your organisation’s IT or security function? If so, do you know what data those tools handle?

Part Three: One Conversation

Based on what you have observed and reflected on this week, identify one conversation you could have before Week 3 that would meaningfully improve your team’s security posture. This might be a conversation with a team member about a behaviour you have observed, a conversation with your IT or security function to understand what controls are in place, a conversation with your line manager about resources or priorities, or a conversation with a supplier about their security practices. The conversation should be specific and purposeful, prompted by something you have noticed or thought about during this week’s learning. Note down what you plan to discuss, with whom, and why you believe it matters. You will have the opportunity to share what came of this conversation in the Week 3 discussion, and to hear from other learners about the conversations they had in their own organisations.

Your observations from your own professional context, across different countries, sectors and organisational cultures, are one of the most valuable aspects of this global learning community. The more honestly and specifically you engage with these reflection tasks, the more you and your fellow learners will benefit.